I'm not 100% sure, but I think we need the df.sanitize_filename() here.
Scripts in this folder are meant to have an "owner" who maintains them.