reel-machine

This code prepares and optionally renders video reels, with no evident data exfiltration, persistence, or destructive behavior beyond replacing files in its bundle. It has a security concern because the unvalidated `name` value controls filesystem paths and is interpolated into generated shell commands without quoting, enabling path traversal or shell injection from a malicious specification. No suspicious domains, URLs, IP addresses, or targeted credentials appear. Severity is moderate if specifications are untrusted; otherwise the behavior is consistent with the stated rendering purpose.