Keep in mind that the extensions can execute arbitrary code inside the app.
This means you should treat them with the same level of scrutiny you treat any apps. Extensions can also read all of the Cloudstream's data. Repos with a are constantly audited by the app developers so you can probably trust them.