input: [Description of Mechanism] JSON blobs and "script src=" [Conforming User Agents] All Can be mitigated with Site Security Policy if sites elect to do so (work in progress). See Script Loading. [Security Considerations] 
output: XSS; CSRF Cookies and Auth (private data) can be sent with requests, and user is unaware that such requests are taking place Mashup Site must trust that Data Site will not XSS it; Mashup Site must "scrub" code. Data Site may be subject to CSRF attacks, since unless API keys are used, script loading may trigger private data leaks. Unless API keys are used, Data Site doesn't get any information about Mashup Site, thus making safety policies hard to construct.