qwen-mm-plugins-video-memory

This script orchestrates video processing, output generation, and optional dependency installation; it shows no direct data theft, persistence, or destructive behavior. A crafted VIDEO_PATH or SCRIPT_DIR may inject Python code through the duration-detection python -c command, so the script has a conditional code-execution risk when those path values are attacker-controlled. It also installs dependencies from https://mirrors[.]aliyun[.]com/pypi/simple/ without fully pinning versions. Overall severity is moderate, based on the path-injection flaw and dependency-source exposure rather than evidence of malware.