product-promo-video

This script generates promotional videos and invokes local rendering, audio, and optional TTS tools; no clear credential theft, covert exfiltration, persistence, or destructive behavior is present. Untrusted briefs can inject markup or script into generated HTML, and bgmVolume can alter an FFmpeg filter graph; YOVOICE_BIN also permits selecting an arbitrary executable. Optional uvx/npx TTS paths may download and run dependencies, and edge-tts uses a network service for speech synthesis. Severity is moderate when briefs or environment settings are untrusted; no suspicious domain or hardcoded secret appears in the fragment.

This code renders a command-line-selected local HTML file into video and image outputs. Its use of --no-sandbox, --disable-web-security, and --allow-file-access-from-files creates a significant risk if the input HTML is untrusted, because its scripts run with weakened browser isolation and may access local resources or make network requests. The code contains no explicit credential harvesting, exfiltration endpoint, or destructive behavior. Severity is a security warning dependent on input trust; relevant paths are the command-line-selected HTML and output files, and the relevant URL scheme is file://.