Well the obvious answer is 100% cause content panes have to have runat="server". Excluding those though I have only seen 4 skins out of around like 100 that have had any server side scripting. 2 of those times it was just a small line that grabbed the server's time for a full date / time field in the skin. The other 2 I didn't really research much. I did convert the two with the time into asxc pages and uploaded them. They worked fine and I didn't feel there was any security piece to worry about. My client has since then removed them though, cause they wanted it to read the same as the time zone they set in DNN but it was bypassing all that and reading the actual server's location.