Honestly, ASF is literally sandboxed. Objects cannot be injected in the runtime. Also, VBA Expressions is intentionally limited to receive and return VBA strings. So, the system is safe for execute code from (almost) anyone.
You can inspect the AST in order to debug your code. For syntax highlighting, use tools like Notepad++ (ASF shares most of the syntax with Javascript). Each piece of code is commented, no obscure machine code.