The problem of security with scid and scon is the same as the one with timer: the parameter of the command is a command itself, which cause the double evaluation; however, scid and scon can be used without a command as a parameter (and you used it that way), in this case there's no problem of double evaluation
