search-lit

The script appears to be a legitimate PubMed E-utilities wrapper with no evident malware or supply-chain backdoor. It contains a security weakness because untrusted search and retmax arguments are interpolated into dynamically generated Python code, potentially enabling local Python code execution. Input should be passed to Python through an argument or environment variable and all URL parameters should be properly encoded and validated. The API key should also be handled without embedding it directly in URLs where practical.