scenescape-setup

No clear evidence of intentional malware (e.g., backdoor, credential theft, or covert exfiltration) is present in this module. The code appears to be a legitimate MQTT-triggered calibration image collector. However, there are meaningful security and operational risks: unsanitized camera_id influences the output filename (potential path traversal/overwrite if an attacker controls camera_id), TLS verification is weakened by combining a CA file with '--insecure' (authenticity may not be enforced as intended), and the external mosquitto Docker image is referenced by a floating tag (supply-chain immutability risk). Overall, treat as low-to-moderate risk pending input hardening and verification of the intended TLS behavior.