Cloudstream 3 Repositories

Keep in mind that the extensions can execute arbitrary code inside the app.

This means you should treat them with the same level of scrutiny you treat any apps. Extensions can also read all of the Cloudstream's data.
The first repo is constantly audited by the app developers so you can probably trust it.