~/badcode$ echo "func" > badfile.go\;\ echo\ \"Gotcha\!\"
~/badcode$ ls
badfile.go; echo "Gotcha!"
~/badcode$ tag func
badfile.go; echo "Gotcha!"
[1] 1:func
~/badcode$ e1
Gotcha! +1
In case that's not clear, I was able to create a file with a name that contains potentially malicious shell commands that is now bound to an alias via tag.