lol, so execution in input files (which are essentially scripts) is somehow unacceptable?  There's always `yaml.safe_load_all` for the paranoid.