* In my recollection, Tcl relies a lot on string interpolation and run time evaluation, both of which carry some risk.

* Perl has a built in taint checking facility which is quite good at preventing the naive use of non-vetted user data; I don't recall whether Tcl has anything similar. https://perldoc.perl.org/perlsec.html