session-story

The script has a meaningful code-injection risk if timeline.json is untrusted: its duration value is interpolated into Python source. With trusted project data, the remaining operations match the documented audio-build purpose; no clear malware behavior is present.