qwen-subtitle

No clear evidence of embedded malware (no eval/exec, no backdoor/persistence, no suspicious obfuscation). However, the script is highly sensitive: it reads an API key from env/config and uses it for authenticated network calls, uploads voice/audio derived from the input video, and executes multiple external binaries (ffmpeg/ffprobe/`bl`/curl) without integrity verification. The highest supply-chain risk is command hijacking via PATH/env-controlled FFMPEG/FFPROBE and the bare `bl` command. Treat the external CLI toolchain and runtime environment as trusted, and review/lock down PATH and environment variables.

This fragment does not provide strong evidence of intentional malware (no exec/eval, no outbound network calls, no credential theft). However, it has a notable security weakness: transcript and track paths are derived from manifest-provided filenames and a client-controlled language selector without path normalization/sandboxing, and the transcript edit endpoint is unauthenticated. If the service is reachable and manifest filenames/symlinks are not fully trusted, it can enable arbitrary or unintended file read/write within the server’s filesystem context.