The only way to tell, if a solution that states that it doesn’t require custom scripts to work, truly doesn’t allow users to embed them, is to review its code. This is tedious and inconvenient but required, if you don’t want to expose your organizational information to risks.