In the process of developing a new scripting extension, akin to Greasemonkey or Chrome's content-script engine, with capabilities to access local files and perform potentially risky actions.
If I decide to make this extension available to the public, I aim to implement a feature that alerts inexperienced users when a script intends to utilize a "dangerous" function. This warning should be difficult to bypass to ensure safety.
One method could involve scanning for a specific protected term like GM_openSQL_Connection in scripts and notifying the user accordingly.
Although the base web page and <script> nodes are sandboxed to prevent access to GM_openSQL_Connection, crafty script writers could find ways to evade detection, such as:
eval (decodeURI ("GM_op%65nSQL_Connection (...);") )
Therefore, the main concern is identifying the potential methods through which a malicious scripter could trick the restricted function check and implementing safeguards against such manipulation.
Note: Occasional false alarms may be acceptable. For instance, if "GM_openSQL_Connection" is part of a static text string used by the script author, they will simply have to ignore the (false) warning.