factory

This is a specification loader that intentionally executes JavaScript from disk. It shows no direct malicious behavior, but accepting untrusted `specPath` content is a significant code-execution risk because Node's `vm` should not be relied upon to sandbox hostile code. Risk depends on whether the specification files are trusted.