subtitle-translate

The script's intended media-muxing behavior is ordinary and no network exfiltration or other explicit malware behavior is evident. However, interpolating the SRT path into Python source creates a local code-injection risk for crafted filenames. The temporary-file construction also leaves an empty file behind.