轻量级业务规则引擎，支持规则定义、规则执行、规则链编排和动态规则加载。 Lightweight business rule engine supporting rule definition, execution, chain orchestration and dynamic rule loading.

This package appears coherent and implements the claimed business rule engine. The main security consideration is that ExpressionEvaluator uses eval() on expressions assembled from rule text and substituted variables — this is expected for a rule engine but is unsafe if rule text or the evaluation context can be provided by untrusted users. Before using in production: (1) ensure rules and context come from trusted sources or sandbox/evaluate in a restricted environment; (2) run the included unit tests (pytest) to validate behavior; (3) review the remaining (truncated) portions of scripts/rule_engine.py for any file, network, or subprocess usage (none were evident in the visible parts); and (4) consider replacing eval-based evaluation with a safe expression parser (ast parsing, boolean-expression library, or dedicated expression evaluator) if you need to accept rules from untrusted users. If you want, I can scan the remaining truncated sections for any hidden I/O, network calls, or other risks.

Type: OpenClaw Skill Name: business-rule-engine Version: 1.0.0 The skill bundle implements a business rule engine that contains a critical security vulnerability in `scripts/rule_engine.py`. The `ExpressionEvaluator` class uses Python's `eval()` function to process rule conditions, which allows for arbitrary code execution if rule definitions are sourced from untrusted input. While the implementation attempts to restrict the environment by clearing `__builtins__`, this is a notoriously weak sandbox that can be bypassed. No evidence of intentional malice or data exfiltration was found, but the use of `eval()` for expression parsing without a robust AST-based evaluator is a high-risk practice.