Comment by varun_ch

I’m not convinced that automated checks will be able to reliably assess whether a plugin is malicious.

I think the best (only?) way to solve the plugin security problem would be to properly sandbox them with an explicit API and permission system.