cali-windmill-orchestration

No clear evidence of intentional malware (no backdoor code, no covert exfiltration beyond the designed LLM call, no destructive actions). The dominant security risk is the LLM-driven dynamic tool/task dispatch: tool names and arguments come directly from untrusted model output and are used to execute scripts under a fixed prefix without an allowlist/validation shown. Additionally, memory_id directly controls Windmill variable keys (potential cross-session/cross-tenant integrity or confidentiality risk if not constrained elsewhere), and llm_resource_path/base_url control the network destination for sending conversation history and using api_key. Verify strict access controls on workflow inputs/resources and enforce allowlisting/schema validation for tool dispatch; also reconcile the runtime/tag inconsistency and confirm the actual deployed callLLM request logic.