is it 100% safe to install Custom Roms I wonder if is possible for those people who download the Android source code and customize it then release their custom roms to hack the API or any other part of the codebase like GMail client or network stack so to push in the rom some kind of spyware, virus and so on...

my main concern is that I like to experiment custom roms made available by any developer online but I really would not like to get my traffic sniffed or my Google Account pwd stolen.

Any idea? is Android safe by default in this way or could it be altered?
No piece of software that you install on any hardware of any form is 100% safe unless you are the author or you've read all of the source code, verified its safety, and built it yourself. Okay, so this may be something of an oversimplification, but it's actually not too far off in most cases.

Custom ROMs are no exception to this. Yes, a ROM author could put spyware, a backdoor, or just about anything else they wanted into a ROM if they wanted to maliciously exploit it. With AOSP ROMs I suppose the possibilities are somewhat magnified since the Android source itself could be modified to contain some kind of exploit or spyware.

It's also worth noting, however, that running a manufacturer stock ROM isn't necessarily a safer option if you're concerned about privacy.

The question "is Android safe by default" is in some ways kind of a meaningless question. Is it designed to be safe? Well yes, data is protected at the application level and apps are sandboxed. Any OS is intended to be safe, but all of that goes out the window when you run a ROM that's not pure AOSP. On top of that, the nature of code is that it has bugs, with Android being no exception. Custom ROMs and manufacturer ROMs alike can absolutely have the potential to introduce (either intentionally or unintentionally) ways for your data to be sniffed or stolen.