execute.js: add obvious comment on exec safety