I recently discovered Vimperator, which is just awesome. However, it concerns me that I can execute shell commands from the browser.. is this exploitable? I'd really hate to get "sudo rm -r /*"'d. I don't know too much about web browsers so I may be worrying about nothing.
Vimperator - as all other extensions - are separated from the web page, so while the extension has full privileges of Firefox (it is in "Chrome" context), web pages can only access "direct" JS features. To be more clear, web pages don't even see whether vimperator is installed or not.
Martin (vimperator developer)