code-review

High-severity command-injection vulnerability in convert_file: user_filename flows into subprocess.run with shell=True. No network destinations, credentials, or file paths beyond the conversion input and output are present. This is a security vulnerability, not evidence of intentional malware; mitigate by using a list of arguments with shell=False.

The function retrieves order totals but has a P1 performance issue from issuing one database query per order ID. It also has a SQL injection risk because order_id is interpolated directly into the query; use parameterized SQL and batch the lookup. No evidence of malware is present in this fragment.