An evaluator-backed task is a workflow step that does not just move data between systems; it asks the platform to interpret scripted input during execution. In practice, the workflow engine passes the task content to an embedded evaluator or scripting runtime, which can process expressions, transforms, or inline code on the server side.
This matters because the evaluator becomes a trust boundary. If untrusted input reaches it, a bug can turn a normal automation feature into remote code execution, data exposure, or privilege abuse. Attackers look for these paths in orchestration platforms, job runners, and CI/CD systems because they can execute before or outside normal application controls. Defenders should restrict who can create or edit such tasks, validate inputs tightly, limit exposed management APIs, and treat embedded scripting as high risk. Patching, segmentation, and monitoring for unusual task definitions are key defenses.