soia-pkm-maintain

No explicit malware indicators (e.g., network exfiltration, credential harvesting, destructive actions) are present in this wrapper’s logic. However, it contains two major security-sensitive behaviors: (1) eval of stdout from maintain_env.py (turning that local file’s output into arbitrary shell execution) and (2) dynamic execution of a caller/configured “original notify” command derived from POST_DASH when --original-count is used. Together, these make the wrapper a high-blast-radius launcher if maintain_env.py or the notify/config inputs can be influenced by an attacker. If all inputs and referenced files are fully trusted, the risk is reduced, but the implementation choices remain security-relevant.