@Worie good idea, I have added a bttReady event (as the BTTInitialize() is indeed different and doesn't ensure the BTT object is available, also BTTInitialize() is always called when the window gets focus, which is important for various use cases.)
<html>
<head>
<script type="text/javascript">
window.addEventListener('bttReady', function (BTT) {
// here the BTT object is available and you can do whatever you want with it:
window.BTT.callHandler('trigger_named',
{
trigger_name: 'action2',
closeFloatingHTMLMenu: 1
})
}
, false);
</script>
</head>
<body>
</body>
</html>
Will be available with the next update later today.
You mentioned security concerns - but the thing is, if somebody can get somebody to have a Floating Web View in BTT, he can also get him to load whatever sequence of actions that could do anything anyways.