Yes. But what you can't do is tell your users what to buy. This malicious complies does not harm the user (directly) but developers.