anti-slop

This is a local HTML story preview/video-rendering tool, not apparent malware. It executes the selected HTML in Chromium and has an unescaped data-slop-to-innerHTML injection path; untrusted input can therefore execute browser-side code and potentially access browser-reachable local services. It also recursively deletes <input-directory>/.story-frames, so pre-existing data at that path may be lost. No suspicious external domain, credential theft, or explicit exfiltration is present in this fragment; overall severity is moderate for untrusted input and destructive-path exposure.