Beyond that, there's a simple matter of advertising: "Share your terminal (read-only)" may mislead some people about what is happening. A more accurate description would be "Give us control of your terminal (we promise we'll only let other people read it, not write anything)".
The only thing sent to shellshare's servers is the text in your bash terminal. There's no return channel for the servers to send commands back to the computer.
You could argue that you're giving control of the terminal because you're running a third-party executable, but that's the same for any executable you run.
So if you are going to use hashpipe, I think you should download it in source form, read it -- it's under 100 SLOC -- and then build it from source yourself. This way, you do that once and then in the future provided that you trust those sending you various scripts and binaries and the channel they used to provide the hash, all is well and no further manual verification is needed on your side of things ever again for any of those.
