Windows Media Creation CLI

The code relies on downloading and executing external OEM driver packages to augment Windows install media. This introduces a high risk of remote code execution if the downloaded artifacts or catalogs are compromised, due to lack of integrity verification (signatures or checksums). No credential harvesting, data exfiltration, obfuscation, or hardcoded secrets were observed. To mitigate risk, implement signature/checksum verification, use trusted/catalog-provided signing, consider sandboxing or staged validation before integrating drivers into the WIM, and prefer vendor-approved APIs or signed catalogs. Ensure least-privilege execution and robust error handling around external tooling.