Do you have only those two dirs at the top level? If so how are you finding it? I tend to have a docs dir at the top level, along with other build stuff
In the script tag you only have access to JS. This allows you to escape JS and have native code execution. It is still sandboxed by os-level primitives, but it is an escalation/first step in successful exploitation.
You cannot explain everything to everyone all the time. Besides, this is not even a paper.
Sometimes you are not the target audience and have to put some words into Google.