[woodruffw]

Some of the checks here seem very brittle. For example this one[1].

In the context of security scanning (versus, say, listing), I think it's reasonable to expect the tool to be resilient to attempts at obfuscation (or just badly written code that doesn't adhere to normal Python idioms around import paths).

[1]: https://github.com/PwnKit-Labs/foxguard/blob/a215faf52dcff56...

[peaktwilight]

update: `NoPickle`/`NoYamlLoad` string-match the callee text, so `import pickle as p; p.loads(...)` and `from pickle import loads as d` slip past. Filed as #7 with a fix plan (intraprocedural alias table). Thanks!