stitched-full-page-capture

This module does not show overt malware, obfuscation, or credential/exfiltration logic. However, it has substantial security exposure when the manifest (or CLI-provided manifest path) is attacker-influenced: it will visit arbitrary URLs using a headless browser (SSRF-like reachability) and it writes stitched and cropped images to filesystem locations derived from manifest-controlled path strings without ensuring they stay within the intended directory (path traversal/arbitrary file overwrite risk). External command invocation uses argument arrays (lower direct shell-injection likelihood), but the impact of untrusted file paths is still high. If the manifest and paths are fully trusted and validated upstream, risk is significantly reduced; otherwise it warrants hardening (path sanitization/allowlisting, URL scheme/network restrictions, and safer manifest handling).