video-shotcraft

The code implements an automated video publishing workflow and contains no clear backdoor, credential theft, exfiltration, persistence, cryptomining, or destructive behavior. The main risks are unrestricted user-selected HTTPS downloads, processing of untrusted media with ffprobe/ffmpeg, and use of privileged GitHub CLI actions. Restricting external URLs to approved domains, validating issue approval independently, applying resource limits, and using least-privilege workflow credentials would reduce risk.