TL;DRThe more plugins you install, the wider the agent's capability surface — and the easier permission questions get skipped in passing. This fixes a judgment order — capability, permissions, maintainer — plus an install path: trial on a copy first, then the main repo.
Sources SOURCES
Distilled from public community discussions. This page only breaks them down and verifies — it never reposts the original; opinions belong to their authors.
Facts FACTS
Check these claims against the listed sources. For allowance mechanics, first-party account displays outrank community summaries.
- The official plugin ecosystem reached 90+ entries in 2026-04 — an explicit stop on the official product-line timeline.
- In 2025-12 the community noticed official support bringing the skills mechanism into ChatGPT and Codex CLI; the discussion drew 587 pts and 324 comments.
- Sandbox and approvals are two independent mechanisms: plugins change what the agent can do, but how far it's allowed to go is still decided by those two layers — a plugin can only push against the gates you configured.
Concepts CONCEPTS
Not everything said in a community thread is a fact — each concept carries its nature label. Read the label first.
Packaging reusable instructions and capabilities for agents to invoke; it entered ChatGPT and Codex CLI as of 2025-12 and is one of the foundations the plugin ecosystem stands on.
The sum of actions the agent can currently execute. Every plugin you install widens it; the widening itself is neutral — the risk depends on the sandbox and approval tiers behind it. A wide surface behind tight gates is a different animal from a wide surface behind loose ones.
Grant only the minimum capability the task needs. An old security principle the community widely applies to plugin selection; the exact line is each team's own call.
90+ is a count; maturity is a judgment. Plugin quality and maintainer discipline vary widely — a big number doesn't mean you can install blind, and counting entries is easy while vetting them is the actual work.
The worry that third-party plugins carry malicious logic comes up repeatedly in security threads, but public real-world cases targeting Codex plugins are still rare — treat as a hypothesis.
Takeaways TAKEAWAYS
Fix the judgment into three questions, always in this order — thirty seconds of screening before anything touches your config. Capability first: is the problem it solves one you've actually hit in real tasks, or does it just look useful? If it doesn't map to your work, skip it. Permissions second: which files does it read, does it need the network, does it execute commands — check those answers against the sandbox and approval tiers you set for the project, and anything beyond expectations means downgrade or walk away. Maintainer third: official output, an active team, or a one-time individual upload — update cadence and issue handling are the hard signals, and a maintainer who answers issues is worth more than a longer feature list. Both signals are visible without installing anything.
The permissions question is the one that gets skipped, because installing a plugin is far easier than configuring a sandbox. That asymmetry is the trap: installation is one click, permission review is homework. Every install widens the agent's capability surface — the surface itself is neutral, and the risk rides on whether the two gating layers keep up. Working out "what's the worst it can do" before installing beats clawing permissions back afterward.
The safe trial path: install on an unimportant project or a repo copy first, run a few real tasks and watch the behavior, then graduate it to the main repo — and remove whatever you don't use, because an uninstalled plugin adds nothing to the surface; removal is a security control too. A 90+ catalog means room to be picky; whatever survives the three questions is what earns a slot in your default setup — which should be a short list you can defend, not a trophy shelf.
Keep reading NEXT
Want today's verdict? Back to the live radar.