cli-demo-generator

This is a command-driven demo-generation utility, not clear malware. Its intended operation executes user-supplied commands through VHS, including hidden bootstrap commands, so it must only process trusted input and run in an isolated environment. Unescaped interpolation into VHS and shell scripts, sourcing /tmp/cw.sh, and predictable temporary-file handling create meaningful command-injection and local race/symlink risks. No evidence of data theft, persistence, or unauthorized network activity is present.