> I think this is clever, and maybe even necessary, but feels risky to do on unaudited third-party Python libraries. This is why my coworker built the project

> I think this is clever, and maybe even necessary, but feels risky to do on unaudited third-party Python libraries. This is why my coworker built the project he called "dowsing"; it tries to understand as much as possible from the setup.py's AST, without actually executing it. https://github.com/python-packaging/dowsing https://github.com/python-packaging/dowsing