Javascript reference external script file - security implications

If I have a reference to 开发者_运维技巧an external third party JavaScript file on my website, what are the security implications? Can the JavaScript file be used to steal cookies?

One example of this is the Google Analytics JavaScript reference file.

Could the third party technically steal cookies or any other sensitive information from my logged on users (XSS)?

The whole cross domain scripting has me confused sometimes.

Thanks!

Yes, the external JavaScript can do anything your own scripts can do. That includes reading cookies and worse: doing things on behalve of your visitors.

Only include JavaScripts from external websites you really, really trust.