Comment by rafram

> It looks for GLOBAL or STACK_GLOBAL instructions referencing dangerous modules like os.system, subprocess, or socket.

This seems like a doomed approach. You can’t make a list of every “dangerous” function in every library.