Yeah but it would have access to also pull all your account data if the repo owner was compromised.