I think an important warning should be, that it can maybe to some extent tell "what's [for sure] in it", but I suspect it definitely shouldn't be used to verify

I think an important warning should be, that it can maybe to some extent tell "what's [for sure] in it", but I suspect it definitely shouldn't be used to verify "what's NOT in it", as in any kind of "security verification". Meaning, if you want to hide some code/malware snippet from it on purpose, I assume you'll definitely find a way to do that. And even if not on purpose, it may still happen accidentally.