video-understand

SUSPICIOUS: The core capabilities fit the stated video-understanding purpose, and most installs come from normal developer channels. The main concern is data flow through OpenRouter as a third-party intermediary for multimodal processing, plus stale/unpinned dependency guidance; this is a medium-risk integration issue rather than confirmed malware.

The code appears to be a legitimate video-processing utility and contains no clear malicious payload or covert data theft. It has meaningful security risks if exposed to untrusted users: unrestricted URL fetching can enable SSRF, downloads lack robust size and timeout controls, URL-derived filenames need sanitization, and external media tools should be sandboxed and resource-limited. Shell injection is not evident because subprocess arguments are passed as lists without `shell=True`.