png-to-svg

The script has a command-injection vulnerability through the user-controlled output filename in `trace_single_color`. A crafted filename can execute Python code when the script reaches the post-processing step. This is a significant local code-execution risk, although no separate malicious behavior is evident.