scenescape-setup

No clear malware behavior is evident. Main concerns are injection into generated Compose configuration from unvalidated payload values, destructive cleanup of paths under deploy_dir, and reliance on unpinned remote assets and container tags.

No clear evidence of intentional malware (e.g., backdoor, credential theft, or covert exfiltration) is present in this module. The code appears to be a legitimate MQTT-triggered calibration image collector. However, there are meaningful security and operational risks: unsanitized camera_id influences the output filename (potential path traversal/overwrite if an attacker controls camera_id), TLS verification is weakened by combining a CA file with '--insecure' (authenticity may not be enforced as intended), and the external mosquitto Docker image is referenced by a floating tag (supply-chain immutability risk). Overall, treat as low-to-moderate risk pending input hardening and verification of the intended TLS behavior.