Edit to add: You don't even need to click on the link, you just need to view an image whose src I can manipulate. Ugh. Seriously: do not install on any environment anywhere.
The reason this is so dangerous is that it needs none of that. All it needs is for your development machine to have access to the internet.
I open up a project, enable this, and run rackup locally.
I then view your Twitter stream, where you've embedded a crafted link behind a URL shortener.
Because that link is executed by me, you've now remotely executed code on my machine. Assuming I'm anything like most Rails shops you can probably get to a number of other machines through my machine.
I should add though that even if this thing gets an XSRF token and it's secure, you might as well take the passwords off your SSH keys if you're running this, because you're coughing up an unprotected remote shell to anyone who can talk to a dev server once you turn this on.
CSRF.