Potential Code Injection Vulnerability

[nevercodecorrect]

Code injection could happen via environment variable. In code here, it directly eval the value from environment variable. A malicous local actor could set something like export is_half='os.system("touch rickroll")' to execute arbitrary commands. It would be better to use ast.literal_eval here. For ref, this issue is similar to CVE-2022-2054.