pdf

The script has a command-injection vulnerability: a crafted output path can introduce shell syntax into the awk system() command that invokes mmdc. The observed behavior is consistent with a rendering utility, and there is no clear evidence of intentional malware, credential theft, or exfiltration. Quote or avoid shell command construction and validate paths before invoking mmdc.