Anything you didn't program yourself should be assumed hostile.

Lots of open source gets a pad because grumpier people than me review it and they seem to have good taste, but I still don't blindly trust it.