Visual Studio has the same problem with C#. By default VS will load all defined analyzers into Roslyn which can execute arbitrary code. VS warns you with a con

Visual Studio has the same problem with C#. By default VS will load all defined analyzers into Roslyn which can execute arbitrary code. VS warns you with a confirmation dialog that shouldn't just be ignored because "I just want to look and not compile". So, don't open any random .csproj or .sln and assume you are safe.