agent-n-video-pipeline

This script generates or reuses audio, transfers it to the configured remote host, and requests video generation through the host's ComfyUI service. It contains a hardcoded SSH password, disables SSH host verification, and interpolates the unvalidated --m5 value into an SSH command, creating credential exposure and command-injection risks. Audio is sent to the configured host, whose default is 192[.]168[.]212[.]46; the shown code does not create the remote workflow file referenced by curl. This is a security alert, but the fragment alone does not establish malicious intent.

This script automates speech-to-video generation and transfers audio and workflow data to a configurable remote host, which is consistent with its stated purpose. The hard-coded SSH password and disabled host-key verification create significant credential and connection-security risks; SPEC interpolation also permits Python code injection if the path is untrusted. No clear unauthorized exfiltration, persistence, destructive behavior, or malware is evident in the fragment. Severity is moderate due to credential exposure and insecure SSH configuration.