studio-workflows

This module submits video jobs to https://openrouter[.]ai and polls or downloads their results. Its poll() and download() methods attach the configured bearer API key to arbitrary absolute URLs, and API-provided polling or output URLs are not origin-validated; attacker-controlled URLs could therefore receive the key. This is a security risk requiring URL-origin validation or omission of Authorization for non-OpenRouter hosts; no other malicious behavior is evident.

No evidence of malware or data exfiltration. The archive CLI has a path traversal risk: unvalidated project or change-slug arguments can direct directory creation and moves outside their intended locations. This requires a user to invoke the archive command with crafted arguments, but should be fixed by validating names and resolving paths to ensure they remain within the intended roots.