create-image-video

This module is primarily an Agnes image-generation API client, but it contains a high-risk configuration-to-shell execution mechanism: values in ~/.pi/agent/auth.json or ~/.pi/agent/models.json that begin with '!' are executed via subprocess.run(..., shell=True) and their stdout is used as the API key. This constitutes an arbitrary command execution pivot if those config files can be tampered with. Additionally, when saving results, it downloads content from an API-provided URL without allowlisting and writes base64-decoded bytes to a user-specified path, which increases the impact of any response tampering. Treat this dependency as high security risk and review/remove the '!'-based command execution behavior.

This module contains a high-risk command execution feature: if the resolved API key value begins with '!', it executes arbitrary shell commands (shell=True) and uses stdout as the API key. Because this value can come from environment variables or local config files, it can enable local code execution (and therefore represents a potential supply-chain/sabotage vector if configs are tampered with). Additionally, when --output is used, it downloads a URL returned by the service and writes it to disk without allowlisting or size/type controls.