UNTRUSTED CODE. OBSERVABLE BEHAVIOR.

Trust the evidence.
Not the README.

Inspect what code actually does in an isolated sandbox.
Follow the signals. Trace every finding back to its source.