# illustrative fixture — not executed. Shipped as .txt so the wheel carries no importable
# vulnerable code (and won't trip a customer's own scanners); `hermes-shield demo` copies it
# into a throwaway temp directory as tools.py and scans that copy.
"""Illustrative only. A dangerous capability that is NOT reached from an entrypoint here."""
import subprocess

def run_shell(cmd):                     # inert in this repo...
    return subprocess.run(cmd, shell=True)   # ...INSTALL-LIABILITY: live once wired to untrusted input
