Pipe it to bash? game over
Pipe it to less/more? Better hope your distro keeps those patched
Open the file in a browser or PDF reader? Hey, look at all this shiny new attack surface!
And as such, you need to already be sandboxing the tool (since it processes untrusted data you received over the internet).
