image-to-threejs

This module appears to be benign image-processing logic (threshold-based foreground detection, bbox calculation, cropping/resizing, and sidecar metadata generation). However, it includes a significant supply-chain/local code execution risk: it prepends a CLI-controlled directory to sys.path and imports extract_pbr_evidence from there, which will execute any import-time code contained in that directory. If the --i2t path (or ~/.local/share/img2threejs by default) can be influenced or replaced by an attacker, arbitrary code execution is possible. Otherwise, the remaining operations are straightforward and non-malicious.