docs: add MVP security comments to expression evaluators

Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Author: Copilot

packages/services/service-automation/src/engine.ts

@@ -224,7 +224,9 @@ export class AutomationEngine implements IAutomationService {
     }
 
     private evaluateCondition(expression: string, variables: Map<string, unknown>): boolean {
-        // Simple template replacement + expression evaluation (MVP version)
+        // MVP: Simple template replacement + expression evaluation.
+        // Flow definitions are authored by trusted developers/admins.
+        // TODO: Replace with safe expression evaluator (e.g., jexl) for production.
         let resolved = expression;
         for (const [key, value] of variables) {
             resolved = resolved.replaceAll(`{${key}}`, String(value));

packages/services/service-automation/src/plugins/logic-nodes-plugin.ts

@@ -25,6 +25,9 @@ export class LogicNodesPlugin implements Plugin {
                 const conditions = (config?.conditions ?? []) as Array<{ label: string; expression: string }>;
 
                 for (const cond of conditions) {
+                    // MVP: Simple template replacement + expression evaluation.
+                    // Flow definitions are authored by trusted developers/admins.
+                    // TODO: Replace with safe expression evaluator (e.g., jexl) for production.
                     let expr = cond.expression;
                     for (const [k, v] of variables) {
                         expr = expr.replaceAll(`{${k}}`, String(v));