[Zooko]

You mean for example, I could write a mod that runs arbitrary code in order to make its decisions, and you could run a game server, and I could send you the mod to run on your game server, and when you run it, my mod could turn out to be a Trojan Horse which steals your bank account numbers and sends hate mail to all of your friends?

I agree that this is a risk. Such risk can be mitigated in three ways:

1. Arrange to have limits on what the code can do. Ideally the only thing it can do is (a) read the turn description file, (b) use some CPU and RAM for a while, and (c) write out a turn move file. It really oughtn't be able to send mail to your friends.

2. Don't run mods from people you don't trust.

3. Insist on mods being public -- ideally open source -- so that any bad Trojan behavior is likely to be detected by people reading the source.