Script interpreters are sandboxed (mainly for realtime safeness [1[). Only the GUI Window and Editor-Actions are whitelisted.
I cannot think of a reason why Session-init scripts cannot be whitelisted either, but so far it isn’t.
 by default neither the os and the io library are available, nor is dofile, loadfile, coroutiine, require. In general anything call that may perform file i/o or syscalls or include external files (which may not be present on other systems) is not allowed.