qwen-mm-plugins-video-edit

The script appears to implement a legitimate video contact-sheet operation and shows no clear malware behavior. However, direct interpolation of the user-controlled FPS value into Python source creates a credible arbitrary Python code-execution vulnerability. FPS and TILE_W should be strictly validated as numeric values and passed to Python without source interpolation; ffmpeg filter parameters should also be validated. The output overwrite behavior is expected but should be documented or guarded if unintended data loss is a concern.