WoW doesn't load anything other than .lua, .xml, .toc and media files (textures, sounds).
Other types of files (apart from any .txt files for changelogs and such) just shouldn't be in your pack.
But even if they are a user would have to manually run them to be at risk.
TL;DR; There is no way for pure Lua addons to "infect" your PC, steal your passwords or whatever.
(malicious addons CAN do some nasty
in-game stuff, like mailing away your gold etc but that's another story)
The easiest way to check that no strange files are in your pack is to
1. Extract it someplace
2. Navigate to that folder with Windows File Explorer
3. Ctrl+F or F3 to open search, put * (asterisk) go to View > Details and sort by File Type
Do you see anything in that list that's not one of those types I mentioned above? (not a folder, .lua, .xml, .toc, .txt, .tga, .blp, .mp3)
Obviously you should also run a virusscan (locally or by uploading to
https://www.virustotal.com/ )