Before installation
- Confirm the repository owner and the exact package or release artifact referenced by the install instructions.
- Read lifecycle scripts and setup commands, especially shell commands and package post-install hooks.
- Check whether the plugin needs API keys, browser sessions, local files, network access, or command execution.
- Look for a license, a maintenance history, and a way to report security problems.
- Record the current harness version and the plugin commit or release you intend to test.
During the first run
- Use disposable or non-sensitive test data.
- Provide scoped credentials instead of primary personal or production keys.
- Observe new network destinations, file changes, spawned processes, and persistent configuration.
- Do not approve a broader permission merely to make an unexplained error disappear.
After installation
- Verify that disabling the plugin returns the harness to the previous working state.
- Subscribe to the repository release or change feed when the plugin handles sensitive capabilities.
- Re-review permissions when a release adds a new dependency, runtime, integration, or install script.
- Remove unused credentials and stale plugins rather than leaving them available indefinitely.
What a DSHub listing does not mean
A listing is not a security certification, malware scan, or warranty. Automated GitHub metadata can establish that a repository exists and has certain public properties; it cannot establish that executing the code is safe for your environment.