[Security] CORS wildcard and eval() usage found

[hhhashexe]

Found via SkillFence scan (npmjs.com/package/skillfence, 76 rules).

Findings in 153 files:

• CORS wildcard (*) in system_prompt.py server config
• eval() in evals.py — dynamic code execution risk
• API key variable patterns in docs

Scan: npx skillfence scan . (Verdict: BLOCK, 31 findings, 14 critical, 6 high)

Recommendation: Restrict CORS origins, replace eval() with safer alternatives.

This is a responsible disclosure via automated security scanning.