The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/onlform_defval.py utilizes the eval() function to parse and resolve custom expressions (e.g., {{Math.random()}}) within field default value configurations. While it attempts to sandbox the execution environment using a restricted globals dictionary, this implementation remains vulnerable to code injection if an attacker can influence the form configuration.
[CREDENTIALS_UNSAFE]: scripts/onlform_jimureport.py contains a hardcoded cryptographic secret SIGNATURE_SECRET = 'dd05f1c54d63749eda95f9fa6d49v442a'. This secret is used to generate signatures for sensitive API endpoints. Hardcoding such secrets in source code facilitates unauthorized API access and signature forgery across different installations using the same skill.
[COMMAND_EXECUTION]: The skill requires the agent to execute multiple Python scripts in the local environment to interact with the backend APIs. The SKILL.md file provides explicit instructions for the agent to use PowerShell or Bash to run these scripts, effectively granting the skill system-level execution capabilities which must be handled with caution.

jeecg-onlform