document-converter-suite

No clear malicious behavior is present. The primary security issue is a path traversal risk through the unsanitized prefix, allowing writes outside output_dir when the prefix contains path separators or traversal components. Image parsing also warrants resource-limit and Pillow-version controls for untrusted inputs. Validate prefix as a safe filename component, resolve and verify the final path remains under output_dir, use atomic exclusive creation, and consider Pillow decompression-bomb/resource limits.