The snapshot helper runs under sudo; with /tmp on its import path any local user could plant a module and run code as root. The Count check helpers and check files now live in a private mktemp directory and python runs with -I. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>