formal-verify

No clear malicious payload or unauthorized data-theft behavior is present. The main risk is intentional dynamic execution of every Python specification file in a user-selected directory; untrusted specifications can execute arbitrary code, access local data, and affect the host process. The tool should only load trusted specification files, and traceback output should be considered potentially information-revealing.