An unsafe dynamic module loading issue exists in the `AgentFlow. resolve pydantic class()` function. When a workflow step utilizes a string `output pydantic` reference, the framework imports a sibling `tools.py` file from the workflow directory using `importlib exec module` without sandboxing. This process ignores the `PRAISONAI ALLOW * TOOLS` environment variables. An attacker who can control a workflow file and its associated `tools.py` can execute arbitrary Python code with the privileges of the workflow runner during execution via `WorkflowManager` or after `load yaml`.