studio-core

This module submits video jobs to https://openrouter[.]ai and polls or downloads their results. Its poll() and download() methods attach the configured bearer API key to arbitrary absolute URLs, and API-provided polling or output URLs are not origin-validated; attacker-controlled URLs could therefore receive the key. This is a security risk requiring URL-origin validation or omission of Authorization for non-OpenRouter hosts; no other malicious behavior is evident.