html-prototype-build

No clear evidence of covert malware (exfiltration, backdoor, or persistence) is present in this fragment. The primary security concerns are functional but sensitive: the tool injects and enables a fixed client-side script in served HTML, and it can spawn an external IDE/editor command derived from `process.env.CODE_EDITOR` (with a more risk-prone `cmd.exe /c` pathway on Windows). If prototype HTML or environment variables are not trusted, this can become an XSS/script-amplification risk and a local command execution risk. If used as intended in a trusted local dev environment, impact is likely limited.