jev-capability-advisor

The code is a cache implementation, not apparent malware. However, unvalidated `key` values are used in filesystem paths; traversal components may permit reads or replacement writes outside the cache directory when the process has suitable permissions. Validate keys against the intended filename format before path construction.