The -safe switch for the interp command does four important things.

1. It causes the following commands to be hidden in the slave:

      cd             exec           exit           fconfigure     file
      glob           load           open           pkg_mkIndex    pwd
      socket         source
   

2. It causes any interpreter created by the slave to be created as if the -safe switch was used – whether it was or not.

3. It causes the expose interpreter-object action to be unavailable in the slave.

4. It causes interp issafe NAME to return true when NAME is the name of the slave. This permits scripts running in the master to be able to recognize slaves that began life with the -safe option. Presumeably this prevents some stupidities.

Interpreters created with the -safe switch are called Safe Base. When slaves are Safe Base, they are essentially deaf, dumb, and blind. But slaves need not remain Safe Base. Scripts running in the master can empower them. When this is done to a slave, it is incorrect to call it "Safe Base" any longer. Even so, the issafe action will report that they are "safe." The point of issafe is clearly to enable master scripts to avoid giving power to arbitrary slaves and not as a test to see what is really safe.

If Tk is going to be loaded into a safe slave of a Tk master interpreter, it must be constrained in a way similar to the version of Tk that appears in the plugin. As yet, there is no simple, stable way of doing this. With the currently experimental version 8.1 there is a safe namespace full of procedures that look interesting. Check it out if you have a need that the plugin cannot satisfy.