Can you use `yaml.safe_load` here?  I guess this file is considered trusted content, but still...  Somehow I mostly avoid `yaml` because of the default ability to inject code and run it.  As far as just defining a few basic attributes I've also used `ConfigObj`.  Apparently matplotlib and IPython also use it.