[kh99]

Well, they definitely could load javascript from another site, and that could be used to trick the user into doing things they think they're doing on your site. I'm not sure it's possible to make a keylogger in javascript, but it probably wouldn't be too hard to trick a user into entering their password though, if that's what you're worried about (in fact that could probably be done just by loading html).

You'd really need someone who knows styles to look it over. But you could start by using "Search in Templates" to search that style for '<script ' (without the quotes). But again you'd need to know something about javascript to know if anything found belongs there or not. Seeing the url of another site anywhere in the code would be one red flag. You could also try searching for '<iframe '. There probably shouldn't be any of those, but again you'd have to know what to look for.