handraw-video-producer

This utility renders HTML frames through Playwright and FFmpeg and writes MP4 or PNG files. Its use of --disable-web-security and --allow-file-access-from-files makes rendering untrusted HTML a significant security concern because page scripts may access local resources or communicate over the network. No explicit credential theft, malicious domain, or destructive behavior is evident in the supplied code. Severity is moderate to high when the HTML is untrusted; the local server binds to 127[.]0[.]0[.]1.

This module provides filesystem draft management and contains no evident malware, network activity, or credential collection. Unvalidated draft names can traverse outside the configured root, and removal or replacement can recursively delete the resulting target; this is a meaningful filesystem safety risk when names are untrusted. No domains, URLs, IP addresses, environment variables, or credentials are present.