agent-creator

No direct evidence in the provided fragment shows hardcoded secrets, explicit network exfiltration to suspicious domains, cryptomining, or persistence mechanisms. However, the design explicitly executes LLM-provided Python via `exec()` in a subprocess and admits that the “exec namespace is not a sandbox” (prompt-contract-only enforcement). This creates a high-impact security risk: if an attacker can influence the snippet/code or bypass intended restrictions, the package becomes a general-purpose code execution mechanism in the build/runtime environment. Treat as high-risk unless the runner is additionally OS-sandboxed (seccomp/container/unprivileged user/locked-down imports/filesystem/network) in code not shown here.

This module is primarily a high-capability code-execution wrapper: it compiles and execs caller-supplied Python in a child process and returns results via JSON while only applying limited RLIMITs. While no overt malware behavior (e.g., hardcoded exfiltration targets) is present in the fragment, the sandboxing is not capability-restricting, so untrusted snippets can still perform broad actions (side effects and data access) and return data via stdout/stderr and emit(). Security risk is therefore high if any attacker can influence `code` or `target`.