Seems like their Content Security Policy should block those from executing as "unsafe-inline" is not allowed.