motion-canvas-agent

The code appears to be a legitimate Vite development plugin for controlling a browser-based animation renderer. It does not show evidence of malware, data theft, persistence, or obfuscation. It has a meaningful security risk if the Vite development server is exposed beyond a trusted local environment because the unauthenticated agent endpoints permit browser control, state and screenshot disclosure, and filesystem writes within the configured screenshot directory. Request-size and input validation are also insufficient.