stitched-full-page-capture

No direct indicators of intentional malware (e.g., credential theft, backdoor commands, data exfiltration) are present in this module. The dominant security concerns are (1) SSRF/reachability-style risk from loading arbitrary pageUrl values from an untrusted manifest with no domain/protocol restrictions, and (2) potential arbitrary file overwrite/write by using manifest-controlled output paths (item.fullPageImage and section.file) to construct ffmpeg output and crop targets without ensuring they remain within articleDir. Command injection via shell is unlikely due to spawn argv usage, but attacker-controlled paths can still lead to unsafe filesystem writes and denial-of-service via ffmpeg.