The consequences for this should be identical to if a maintainer had added a "rm -rf ~" or similar command in a project, with severity of punishment scaled by the popularity of the project.
If your agent executes any random instruction in a piece of text, it behaves like a shell, and you should either fix that or bury it deep in a sandbox.