cinematic-film

This utility generates textures and grades project images, with no evident malware, network exfiltration, or command execution. If photos.json is attacker-controlled, photos[].file can cause reads of image files outside the project and photos[].id can direct JPEG writes outside the intended output directory. This is a filesystem path traversal risk; no specific external domains, URLs, IPs, or credentials are involved.

This is an image-search, download, and attribution utility, not evident malware. Its main risks arise when processing untrusted photos.json: url can trigger requests to arbitrary destinations, and file or id can enable path traversal writes outside assets/photos; no credentials, suspicious fixed domains, or malware behaviors are observed. Overall severity is moderate and depends on whether project metadata is trusted.

This is a local audio-generation utility and contains no evident network exfiltration or malware behavior. The caller-provided --cmd is intentionally executed through a shell, and unvalidated take names from script.json can cause path traversal or unintended file writes; these risks are significant when command arguments or project scripts are untrusted. Severity is moderate and context-dependent.