sn-ppt-workbench

This module primarily functions as a local orchestrator and WebUI launcher, not as self-contained malicious logic. However, it has meaningful security risk typical of supply-chain/host-compromise scenarios: it executes a local .mjs launcher path that can be influenced by environment variables and local filesystem state without integrity verification, and it forwards sensitive configuration (including API keys and a free-form --acp-command) to the launched runtime. It also sends Bearer tokens to a configured gateway during a probing step. If an attacker can influence the environment variables, .env contents, or the launcher file location on disk, the impact could be substantial (process-execution trust boundary).