painted-animation

The fragment appears to implement browser-based artwork rendering and export. The indirect `eval` of string values from `renderSheet`'s `at` argument creates a code-injection risk if that argument can be influenced by untrusted callers. No clear evidence of malware is present in the visible code.