motion-designer

This script renders a local HTML timeline and audio into video files, but it has a high-impact code-injection path: an untrusted HTML page can control window.DUR, which is interpolated into Python source and executed. Chromium also runs the page with local-file access enabled. The script recursively deletes the HTML directory's _slices subdirectory as temporary cleanup; no network exfiltration or credential harvesting is present in this fragment. Treat as a security alert and do not render untrusted HTML without fixing the interpolation.