brand-illustrate

No strong evidence of built-in stealth malware (no exfiltration, credential theft, or obfuscated payloads) in this module. The primary security risk is supply-chain/orchestration: it dynamically discovers and executes external backend scripts/executables based on environment variables and configurable directory roots, creating a serious arbitrary code execution boundary if those locations are attacker-influenced. Separately, it generates gallery.html with unescaped untrusted values (caption/sub/src/attributes), creating a plausible HTML injection/XSS risk when opening the generated gallery if an attacker can control files/metadata under the scanned directory.