> I think this is clever, and maybe even necessary, but feels risky to do on unaudited third-party Python libraries.
This is why my coworker built the project he called "dowsing"; it tries to understand as much as possible from the setup.py's AST, without actually executing it.