kelly-mv

This module is a local inference orchestrator with comparatively low evidence of direct malware in the wrapper code itself (no network/exfiltration/backdoor behavior observed). The main security concerns are trust-boundary weaknesses: caller-controlled output paths drive directory creation and file rename/move without containment/validation (potential overwrite/path traversal impact within process permissions), and process.env.LTX_CONFIG is used to select a config file path without sanitization/allowlisting (potential unsafe config selection). Additionally, forwarding the entire environment to the Python child increases exposure if the bundled inference code logs or mishandles environment data.