Consider the following: localhost:5601/app/kibana#/dev_tools/console?load_from=malicious_script.json

Kibana probably needs a whitelist for domains to load from to protect against malicious usage (even though Console doesn't run the Sense scripts automatically). As an attacker I can easily trick the user to do stuff that he will regret later and I believe Kibana at least shouldn't make it that easy for them.