render-3d-product-showcase

No clear evidence of credential theft or overt malware behavior is present in this Python fragment. The main concerns are (1) embedding attacker-controlled SVG markup inline into generated HTML with only minimal string edits (no true sanitization/allowlisting), (2) rendering that HTML via an external Node script/headless browser (shoot.js), which is a major capability boundary and could allow active content or unintended resource access depending on sandbox settings, (3) use of tempfile.mktemp for temp paths (race/symlink/TOCTOU risk), and (4) remote Google Fonts fetch during rendering (network egress). Overall, this appears to be a rendering/asset-generation utility with a meaningful security risk surface in a supply-chain context; further review of shoot.js and its sandbox/network policy is necessary to determine exploitability.