
  Is there anything that a malicious user could still do even with these restrictions in place?


It depends on your definition of "malicious". Running a tight loop or otherwise consuming huge amounts of resources is arguably malicious. Serving up a fake PayPal front is malicious, but certainly not prevented by these features.

You pick the level and type of insecurity you're willing to tolerate based on the features you feel you need. And then over time you might adjust based on usage.

Security concerns with a "fiddle" site?
I set up my ssh stuff with the help of this guide, and it used to work well (I could run hg push without being asked for a passphrase). What could have happened between then and now, considering that I'm still using the same home directory.

$ cat .hg/hgrc 
[paths]
default = ssh://hg@bitbucket.org/tshepang/bloog

$ hg push
Enter passphrase for key '/home/wena/.ssh/id_rsa': 
pushing to ssh://hg@bitbucket.org/tshepang/bloog
searching for changes
...

