p5-paint-animation

No direct, built-in malware payload is evident in this module (no hardcoded secrets, no explicit exfiltration/network behavior, no filesystem tampering beyond writing the screenshot). The primary security risk is that this code intentionally executes untrusted, caller-provided JavaScript in a headless Chromium page (plus optional additional injected script via --inject), and it can embed local file bytes (via --image) into the page context. Therefore, treat it as high-impact when inputs are not fully trusted; security hinges on the effectiveness of hardenPage(page) and browser sandbox/egress restrictions.