cause a security vulnerabilities. Not fixed are a number of more subtle
cases which may or may not allow security violations (I don't have time
to conduct a thorough audit now), and which are difficult/impossible to
fix anyway without something like fmtcheck(). Document this in
pkg-install and remove FORBIDDEN tag.
