obsidian-visuals

No overt signs of traditional malware (no network exfiltration, subprocess execution, or credential theft) are evident in this module. However, the code contains two significant security hazards: (1) eval() of a user-controlled --expr string (dynamic code execution risk) and (2) writing images to an attacker-controlled --output path without validation (arbitrary file write/overwrite risk within process permissions). Additionally, unbounded numeric inputs can cause denial-of-service via heavy plotting/rendering. Treat as unsafe for untrusted CLI inputs, especially for --expr and --output.