Michael Tsai - Blog - Malicious Shortcuts

I didn’t think of this but it’s right, it would be really easy to make a shortcut that pulled a copy of all sorts of data from your phone and then had the user send it to you. To be clear, the user would have to willingly go along for the ride. It wouldn't be possible to do this automatically. But you could pretty quickly fool people I would think.