simple_html_docgen

The server uses `os/exec` to run external tools like `pandoc` and `go-rod` (headless Chrome) for document export. While the arguments are constructed programmatically, relying on external executables always introduces a potential attack surface if those tools have vulnerabilities or if crafted HTML content can exploit them for command injection. No direct `eval` or obvious shell injection points were found within the application's argument handling. `source_path` for `add_media` copies files without executing them, mitigating direct execution risk for media files. No hardcoded secrets or unexpected network activities beyond Chrome auto-download are present.