Would they need to be written in a full programming language? Why not just a list of declarative statements with conditionals, executed in order? I'm not an expert on these things but I don't see how one could do anything malicious with that.