Concise Guide for Evaluating OSS: Questions 9.i. and 10.v. seem redundant

[haxtibal]

Hi folks, is there a meaningful difference between

9.i. Try adding the dependency as a test, preferably in an isolated environment, to investigate its impact: Does it exhibit malicious behaviour, e.g., does it attempt to exfiltrate sensitive data?

10.v. Consider running the software in a sandbox to attempt to trigger and detect malicious code.

I'd do the same in both cases: Run dependency in test machine/container without network connection and look for unexpected CPU usage, network connections and file access. If it's really the same, one of the two questions could be dropped. If not, maybe add some explaining words.

PS: Thanks for making this guide!