As far as I can see, it's the same as with any software: either you need good sandboxing, or you need to (read the source or) trust the developer. In-browser software at least has the advantage that it is well-sandboxed (you can be sure that the software isn't accessing arbitrary files on your disk other than the one you gave it access to, and cannot install a virus or whatever), and the tools needed for monitoring and disabling network access (dev tools) are built-in to the browser (don't have to separately install Little Snitch etc).

One mitigation against the risk of software "updates" (malicious code getting added later), if you trust or have verified one particular version of such a webpage, is to save the HTML file (put it in a Dropbox folder say) and open the file (maybe with network disabled), whenever you need to use it. But then you lose the advantage of "don't have to install anything"; it's a trade-off.