What a Claude Code mod can do with your permissions

What can a Claude Code mod actually do on my machine, and what should I review before I allow one? A mod runs inside Claude Code, without a sandbox, using the permissions of the user who installed it.