[Security] CORS wildcard and eval() usage found

Found via SkillFence scan (npmjs.com/package/skillfence, 76 rules).

Findings in 153 files:
- CORS wildcard (*) in system_prompt.py server config
- eval() in evals.py — dynamic code execution risk
- API key variable patterns in docs

Scan: npx skillfence scan . (Verdict: BLOCK, 31 findings, 14 critical, 6 high)

Recommendation: Restrict CORS origins, replace eval() with safer alternatives.

This is a responsible disclosure via automated security scanning.