What commands specifically? The potential trouble I can see is you not escaping special characters in the JSON. The default way to overcome this limitation is to convert the thing you want escaped to base64, but you will get about a 33% overhead in payload size.

If you read the documentation of binary_to_term, then you can notice that you can use the safe option to avoid creation of new atoms, by default it should work with everything. At the same time this option you are mentioning doesn’t make much sense, as you are literally dealing with a big string that is your template, not with a data structure, if you are asking wether using term_to_binary instead of json is better, then kinda, you get the smaller payload at the price of more incovinient debugging.

Needlessly to say, there are various dangers involved with what you are trying to do. If your eex templates are not created by a trusted party, then you are in for a not fun time, as there is no concept of sandboxing around eex templates, you are better off with using something like luerl if the potential executed templates are unsafe.

Yep, Base64 is pretty bullet-proof in terms of putting “any kind of thing” into JSON.

It doesn’t matter in what format you save the file. Once you do something like EEx.eval_string, you will be executing code from the context of your VM, having the exact same access level as the code you have in your codebase. For example I could send you a template with the following:

<%= Ecto.Adapters.SQL.query(MyRepo, "DROP SCHEMA public CASCADE;") %>

This thing will drop all the tables in your current database, no warnings, assuming I know your repo module, but that can be determined fairly trivial.

Looking at the examples you provided though, it seems that you want to use eex templates to generate local vedored components. This is a nice idea, but the execution is a bit strange, I would personally define those components as .ex files and use something like igniter for the actual mix task, as you have a lot of source code in those templates and it is pretty hard to read and maintain them. Using this method also overcomes all dangers with getting unsafe templates, as igniter operates on AST, it is not actually executing code.