Sure, but I don't expect build to execute arbitrary code. That's a big difference.

It's like if `git clone` ran random stuff from the cloned repo.