better-chatbot

The server uses `new Function()` for JavaScript execution and `pyodide.runPythonAsync` for Python execution. While these are inherently risky, the code attempts to mitigate this by running in the user's browser (client-side) and includes basic safety checks (e.g., forbidden keywords, suspicious patterns). The `httpFetchTool` allows the LLM to make arbitrary HTTP requests from the server, which could lead to Server-Side Request Forgery (SSRF) or unauthorized data access if not strictly controlled by LLM system prompts and/or network configurations (e.g., whitelisting). Sensitive API keys and configurations are correctly handled via environment variables. Input validation is applied using Zod schemas. Overall, conscious efforts are made towards security, but the dynamic tool usage requires vigilant monitoring and strong LLM guardrails.