imessage-video-ad

SUSPICIOUS: the core media-rendering capability is coherent and mostly benign, but the skill overstates that everything is bundled while defaulting to an external GooseWorks dependency and optionally sending assets/prompts to fal.ai. This is a medium-risk, supply-chain and transitive-trust issue rather than confirmed malware.

No direct malicious payload is evident in the snippet, but the module is security-sensitive when CLI inputs are not fully trusted. The two primary concerns are (1) command execution risk due to execSync with a shell-interpreted ffmpeg command string using attacker-influenced paths, and (2) unsafe injection of raw, insufficiently sanitized SVG markup into HTML rendered by Chromium via page.setContent, which can enable active content execution/resource loading in the rendering context. Treat this as a high-risk build/render tool requiring strict input trust, sanitization/escaping, and safer process invocation (spawn/execFile with argument arrays).