Basically, they use CBC-MAC to verify the integrity of their script sources. This is pretty bad because a MAC is not resistant to collisions, and given the original key, it's trivial to generate alternate data that gives the same output. A better approach would be an HMAC, using something like SHA1. Doing so makes it much more difficult to perform this type of attack.
Legitimate question: can someone tell me why something like this would be useful? Don't most libraries that handle json decoding make parsing it extremely easy? I read through the examples on the site, and I'm still not convinced something like JSONPath is necessary for what they're doing.
I think you underestimate how easy it is to exploit buffer overflows on systems with no exploit mitigations. Come back when you have ASLR and DEP running on the gameboy.
What's preventing someone from purchasing a GPL/BSD license for the source code, and then hosting it publicly (with licenses intact) somewhere, say, github?
It's particularly useless for anything else, really. Not to mention it's in a completely un-portable format. One can only hope this was generated automatically.