How malicious ETH smart contracts can be?

[DerekVazz]

Hi!
What is the worst thing that a smart contract may do if I run it?
For example I have some ETH coins on an address. And I want to receive some tokens to this same address. Once I received these tokens I'll send em to someone at some point by executing a function like "transfer" in ERC20. Can a smart contract have a malicious "transfer" function that will also send my ETH to a contract owner without me knowing that?

[DerekVazz]

No ethereum and smart contract experts here?
Maybe I'm asking in the wrong section - in this case please point me to the right section here
Thanks!