I'm not versed in this programming, but do have suggestions about where to prevent macro:
Prevent macro execution at drive root and OS critical (c:/ & c:/windows* & c:/progra*) folders.
Prevent macro execution at same folder that contains HFS.exe, because takeover risk.
Prevent archive at webroot (./) because archive all is overload (archive can't work then).
P.S.
Also a question: Can macros be run non-block/async?
I ask because, if you run a macro loop in HFS then it is completely stuck until loop end (this condition serves 1 or zero users).