wan-video-clone

This module appears to be a legitimate media transformation pipeline, but it contains high-impact security issues for a supply-chain reviewed CLI: it disables TLS certificate validation globally (enabling MITM tampering of uploads/polls/downloads) and it uses execSync shell command execution for ffmpeg/ffprobe based on interpolated command strings. It also writes remote-fetched bytes directly to disk and generates an FFmpeg concat list without escaping. While clear malware/backdoor behavior is not evident, the security posture is sufficiently risky that the tool should be hardened (enable TLS verification, replace execSync with spawn/args, validate/sanitize all CLI-derived values, and escape concat list entries) before use in untrusted environments.