html-to-pdf

The code appears to be a legitimate HTML-to-PDF utility and shows no evidence of malware, credential theft, persistence, or covert exfiltration. It has material security risks: shell command injection through the output path, unrestricted remote URL fetching, execution of attacker-controlled HTML/JavaScript, and disabled Chromium sandboxing. The output path should be passed to pdfinfo without a shell, untrusted content should be isolated, URL access should be restricted, and Chromium sandboxing should remain enabled where possible.