In reply to Kevin Smothers.

There are some false positives that will be corrected in the next few days (backticks in sql, false variable functions in printf). But some checks report true suspicious code : use of curl_exec, use of iframe, etc. One may use them in its own theme, but since the target of themecheck.org is people who download or distribute themes, theses warnings seem legit.