Sure, without exploits they can steal your api keys, read your personal data, and access your browser data. With exploits they can update packages on your computer too.
replyNo exploits needed. A simple shell alias will suffice. See my example in sibling comment.
reply