video-add-captions

No direct evidence of intentional Python malware (e.g., data theft/exfiltration, reverse shells, or embedded payload execution) is present in this module. The primary security risk is execution-chain and supply-chain exposure: it shells out to npx/hyperframes to generate snapshots and executes ffmpeg on media paths derived from input bindings, and it modifies sys.path to import helper modules from a computed directory. With trusted deployment artifacts and pinned/controlled external tooling, risk is likely moderate; with untrusted environment/artifacts, it could support an execution-chain attack. Confidence is limited by the provided snippet’s apparent truncation in _color_rgb().