video-processing

The code appears to be a legitimate FFmpeg wrapper and shows no clear malware or supply-chain backdoor behavior. It contains a high-impact avoidable eval-based code-execution risk if attacker-controlled ffprobe metadata can reach r_frame_rate, plus temporary-file race/symlink and concat-filename escaping issues. Replace eval with strict numeric parsing, use a securely created temporary file, escape concat entries, validate subprocess results, and avoid overwriting sensitive outputs by default.