sigil-scan

The code is primarily benign CLI support logic, but the Python fallback in merge_scan_json contains a code-injection vulnerability when target is untrusted. Use JSON serialization or pass the value through stdin/environment rather than interpolating it into Python source. No clear malware behavior is present.