The software is FOSS, so it goes without saying that the author most likely has not intentionally hidden any back doors in the software. A cursory search and browse suggests that the code makes no attempt to access any servers or networks outside of salesforce.com, does not perform any disk activity outside that needed to process ZIP files, bulk API requests, etc, and appears to have no abnormal security flaws.
From a brief skimming, there appears to be no unusual bugs that would cause crashes or hangs, although there (however unlikely) may be obscure bugs that would require deeper analysis. The code is written in a straight-forward manner with no obfuscation of variable names, dictionary keys, method names, etc. All connections are secured with OpenSSL, all messages appear to be well-formed and properly escaped, etc. The code is legible and appears well-formed.
Of course, as with most tools that interface with salesforce.com, your username and password are stored in the clear, meaning that you should take appropriate measures to restrict access to your workspace files through whatever mechanisms your OS provides for locking down file access (Unix-like permissions should be 0600/0700, Windows permissions should grant access only to SYSTEM, Administrators, and you), and possibly encrypted as a whole if you were paranoid (EFS or equivalent). Note that data will inevitably reside on your hard drive as a result of using this plugin. All data appears to be contained in the workspace folder/directory. Securing your workspace folder should be considered important if you do not want to risk exposing client data.
In summary, short of some odd user-facing messages and comments that simply suggest that American English is not the author's native language (e.g. "This command is ongoing" instead of something closer to "The command is executing" or "Executing command"), which is not a problem, as the messages are still intelligible, there are no obvious security flaws or blatantly obscured code that would suggest any real security concerns. Please note that although I am a professional developer, I am by no means a security consultant, so you should probably take the time to examine the software closely yourself, or, if you are not familiar with Python, find someone who is.
