There are no such features. There is little difference in practice between "oh this program does bad things at compile-time" and "oh this program does bad things at runtime" and usually you compile a program in order to run it afterwards...
Having said that, we could add a `--confirm` switch to Nim and then the compiler asks you for confirmation before every staticExec run. Using regexes for this will never work reliably and simply create a false sense of security.
