What are the potential security issues when importing an entity type? I'm working on a module.

If the module is enabled, there would be an overview page showing the field structure of different content types. The visitor could then click a button to get a copy of the bundle's field structure (JSON encoded) and then use the code to create that content type on their site. Basically, like a feature except copy and paste rather than download.

What would potential security issues be? Is there any way to ensure that the hosting site (the site the content type is copied from) won't be able to do anything malicious?
Who would you expose this feature to?

If it's users with one of the permissions listed on http://drupal.org/security-advisory-policy then you shouldn't really worry about the security implications because those users can already do a lot of malicious things to the site.

I believe that all field names and field values should be filtered appropriately already and Drupal handles filtering on output, so I don't see a need for something like xss filter during import.

The fact that you want to use JSON instead of a PHP array as the method to represent the code seems great: copy/pasting PHP arrays around is an easy way to create an arbitrary code execution problem.

There is more discussion about safe ways to offer this feature in an issue in the Views queue.

If this doesn't answer your question please leave a comment and I'll do my best to expand.