That's worth bringing up, but it's not eval that causes a problem, it's access to environments, especially mutable access. You can implement eval as an interpre

That's worth bringing up, but it's not eval that causes a problem, it's access to environments, especially mutable access. You can implement eval as an interpreter in your own Scheme program, so supplying it as primitive can have no extra consequences; conversely if you have first-class environments, passing (the-environment) to some opaque procedure would do all the damage to analyzability already.