Ethereum Cookbook

There's more...

External contract calls to untrusted contracts can be very harmful. With a method like delegatecall, the target contract can modify any state variable and even steal all your money. It is not at all recommended to use a third-party contract that is not trustworthy.

Furthermore, a malicious external contract can throw an exception every time. This will cause the condition in the calling contract to fail. This can lead to some sort of denial-of-service attack and even make your contract permanently useless.