Good stuff, all.
BlizEdward wrote:
At the beginning there was a small thing in there (the team said "as a proof of concept") that could influence your character behaviour, i.e. execute emotes without player input in certain situations. They have since taken it out.
To expand on what ME said:
First off, LUA is the language used to make a customized UI - apparently it's similar to XML. Second, the WoW client can compile LUA on the fly and at one point during beta, it was also able to read compiled code (I believe the compiled LUA code was smaller and may have been a little more efficient in terms of execution).
The concern was that if compiled LUA was supported by the WoW client, people could release UIs and those who used them could not be assured there was no malicious code (such as not being able to attack certain PCs or forced emotes as ME mentioned) in the UI. Blizzard discontinued their support of compiled LUA once Cosmos demonstrated this and now will only process uncompiled LUA code, giving users the opportunity to look at each line of code before they choose to install it.
Incidentally, there were a few wingnuts who really flew off the handle once this embedded code was discovered. So if you hear someone ranting about how you shouldn't trust Cosmos, back away from the crazy person and call the guys in white coats.