paper-cutout-remotion

This module is a wrapper around an external CLI (apiz) that (1) executes a binary chosen via the APIZ_BIN environment variable and (2) downloads remote content from URLs extracted from untrusted apiz JSON output with minimal validation, then writes the bytes to a caller-specified local path. No direct in-module credential theft/persistence/obfuscation is apparent. The main security concern is moderate-to-high risk in the surrounding threat model: if APIZ_BIN or apiz output/URLs can be influenced (or apiz is compromised), the wrapper enables SSRF-like network fetches and arbitrary file writes. Constrain/allowlist APIZ_BIN, validate/allowlist download URLs (hosts/schemes, block private networks), and restrict output paths and download sizes/content types.