What jussik is referring to is that they can add whatever they want to their repository and you are none the wiser of it. So while they don't have a full root access, they can put whatever they want in their repo and call it whatever they want. Also, anyone can add a repo to gronmayer's site, so you should probably research before installing them. While there is a small chance of someone doing it, they could host a malicious program and name it some updated version of a file everyone wants or some new game people are asking for. When you allow someone access to your system, you should always be sure you can trust them. It's like letting someone borrow your car, you don't give it to just anyone. Also, you are right, they don't get all your personal info just by adding their repo, they would have to inject a malicious file first, which they could feasibly do. Hope that helps clear things up.