Suppose you are a malicious smart contract developer and embedded an inline transaction in your smart contract that calls
eosio.token::transfer 100 eos from the caller's account to your account.
An unsuspecting user calls your contract's
makepokemon action, and it calls an inline action that tries to take that 100 tokens. It didn't work, because cleos says that it's "missing required auth". That's because the
makepokemon action requires auth of the user that's trying to make the pokemon.
So the user pushes the action with -p user@active, and now the contract can "steal" those tokens unrightfully? Or am I missing something?
disclaimer: I'm new to EOS and have only been messing around with tutorials and a local testnet, I might be oblivious to other things