sb-inventory

No clear malware behavior is present. The script is a documentation generator, but untrusted component names or storiesLocation values could cause writes outside the intended directory, and unescaped values could inject content into generated MDX. Validate names and enforce that resolved output paths remain within an approved root.