[QGIS-Developer] How to deal with QGIS plugins which install additional packages

[Greg Troxel]

Thomas B via QGIS-Developer <qgis-developer at lists.osgeo.org> writes:

> Dear QGIS-Developers,
>
> Are there any guidelines from the QGIS project regarding whether a QGIS
> plugin is allowed to autonomously install required packages using PIP or
> similar tools without manual installation by the user?
>
> While this might seem convenient, I see it as a potential security risk,
> especially if the user is not explicitly informed about what is happening
> in the background.

Agreed this is not ok.  I think a plugin downloading anything to be
executed or interpreted should be entirely prohibited.