sp-create-video

This utility renders a caller-supplied local HTML board and writes frame screenshots, but it recursively deletes the selected output directory before capture, creating a significant data-loss risk if the path is misconfigured. Loading untrusted board HTML with Chrome's --allow-file-access-from-files also increases local-file exposure; no external exfiltration or other clear malware behavior is present in this fragment. Severity: medium, primarily due to destructive output-path handling and execution of potentially untrusted local HTML.