fix: replace insecure eval() with safe parsing in reflection.py

[dajiaohuang]

What

Replaces the command execution vulnerability in ReflectionAgent where LLM-generated output was directly evaluated using eval().

Why

Issue #147 reported a security vulnerability: the code used eval("self._" + output) to process LLM responses, which could allow command execution if the LLM output was manipulated by an attacker.

How

The fix replaces eval() with:

1. Regex-based function name detection (say(, act(, do_nothing()
2. ast.literal_eval() for safe argument parsing
3. getattr() to call the appropriate internal method (_say or _act)

This ensures only the expected method calls can be made with safely-parsed arguments.

Testing

• Syntax check passed
• The fix maintains backward compatibility with the existing output format
• No changes to the method signatures of _say() or _act()

Related Issue

Fixes #147

Security Note

This is a security fix. The original code allowed arbitrary code execution through LLM prompt injection. The new code restricts execution to only the _say, _act, and do_nothing methods with safely parsed arguments.