langchain-fundamentals
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- Dynamic Code Evaluation: The skill contains example implementations of mathematical evaluation tools in both Python and TypeScript that use the
eval()function to compute expressions. - Context: Using
eval()on arbitrary string inputs poses a potential code execution risk if user-controlled or unvalidated parameters are passed to the tool. While intended here as a math calculator example, it represents a pattern that should be handled with strict sandboxing or replaced with safe mathematical parsing libraries in production environments. - Evidence (Python):
return str(eval(expression))insidedef calculate(expression: str)inSKILL.md. - Evidence (TypeScript):
async ({ expression }) => String(eval(expression))insideconst calculate = tool(...)inSKILL.md.
Audit Metadata