I think it should be possible to block or put a warning on file write operations, perhaps sockets too although it wouldn't be at all hard for a trojaner to make their script connect to a server and send the info over an IRC-based connection instead. However if you get to that level of command restriction I think it would have to be able to be set on a per-script-file basis (and also for the command-line of course), since people could often have different scripts which they trust to varying degrees. I certainly don't think any such options should be on by default though, it would cause way too many disruptions.
I don't think protection from an imported ini file is really needed, if people are stupid enough to load the settings provided with a script they don't trust then that's their own fault.
