You can then make this command available in the safe slave interpreter via the alias mechanism that adds new functions to the safe-interpreter domain. The code running in the safe interpreter can use this crippled command only to access files. These extra functions are one of the principal ways in which information can be passed out of safe interpreters. Assessing the safety features of TCL can be a long, drawn-out project. The designers of TCL 7.5 left out all the obvious ways in which a TCL program could breach the walls of the interpreter and mess up a system.
Information can enter and leave only through the additional functions that a programmer adds.
This is why the padded-cell analogy is so accurate. Some consider this model to be limiting. Telescript, for instance, offers a place where multiple agents can come and meet. The system also contains a permit mechanism that controls which features are available to which agents and can even limit how an agent consumes system resources, such as CPU time or memory. This more sophisticated environment can make complicated rendezvous scenarios easier to create, but it might also inadvertently add security holes.