I am looking into using some add-on that automated a mail merge from Google Spreadsheet data, via Google Doc templates, to PDFs that get emailed out.
Several add-ons that I looked into (such as autocrat) require, when attempting to install them, extensive permissions including full access to all of my Drive files and the ability to send email as me.
What kind of risks are there in installing such an add-on? Can it e.g. email back to its developers sensitive files from my Drive? And how can I mitigate some/all of these risks? (E.g. is it possible to extract the add-on source, verify it doesn't contain any funny stuff, and then install my own version of it?)