Note that <script src>'ing from some random website means that site can XSS you any time it wants to. (I'm not saying the owners intend for this; a third party could just as well hack their site and do the same.)