soia-pkm-maintain

This module is primarily a functional wrapper, but it contains high-impact execution primitives: it evals output from a bundled Python helper (shell code execution in the wrapper) and can execute an “original notify” command constructed from caller-provided tokens (arbitrary command execution if those inputs are attacker-controlled). The session logging script is invoked with vault/log-dir parameters that originate from environment/argv, and failures are intentionally suppressed, reducing detection/forensics. While there is no direct evidence of exfiltration or backdoor logic in this fragment, the attack surface is significant; review maintain_env.py and session_end_log.sh and ensure wrapper inputs/config are trusted and integrity-protected.