office-quotes

No overt backdoor or direct malware behavior is evident. The primary security concern is the unsafe rendering pipeline: the tool fetches untrusted SVG from a remote API, embeds it verbatim into HTML, and renders it in headless Chromium via file:// before screenshotting. If the upstream API (or network path) can be influenced to serve malicious/active SVG content, this could lead to unexpected browser-context behavior (e.g., outbound resource requests or other renderer-driven side effects). Treat the API SVG as untrusted and consider sanitization/validation and/or stricter browser rendering constraints.