The uSuite tools run locally and send nothing over the network, but they open files from disk, run hook commands you configure, and read their settings from ~/.config/. If you find a way for a crafted image, folder, sidecar, memo or config file to do something it should not, please report it privately through GitHub's "Report a vulnerability" button on the repository's Security tab rather than in a public issue. You will get an answer within a week.