Every plugin runs in nerd’s macOS sandbox. Besides showing things in nerd and writing its own data folder, it writes only to the folders its manifest names, reaches the network only as its manifest names and speaks only for the agents it names. Reading is wider, as for any program you run: the command lines and environments of your other programs, so a key in an environment variable is readable to it, and your files except those the plugin guide names: the folders ~/.ssh, ~/.aws, ~/.gnupg, ~/.docker, ~/.kube, ~/.azure, ~/.config/gh, ~/.config/gcloud, the whole of ~/Library (keychains, cookies, browsers, mail) and nerd's state root (sessions, screens, logs, other plugins and their data); the files ~/.netrc, ~/.npmrc and ~/.pypirc; the shell histories ~/.zsh_history, ~/.zsh_sessions, ~/.bash_history, ~/.bash_sessions, ~/.sh_history, ~/.history, ~/.local/share/fish and ~/.local/share/atuin; and the histories of python, node, psql, mysql, sqlite3, irb and less: ~/.python_history, ~/.node_repl_history, ~/.psql_history, ~/.mysql_history, ~/.sqlite_history, ~/.irb_history and ~/.lesshst. Any other file in your home folder is readable, token files such as ~/.codex/auth.json and ~/.git-credentials included, except as the plugin guide goes on to say: “A denied file covers every name that begins with it (~/.zsh_history.new, where zsh writes the history before renaming it). A link inside a denied folder other than ~/Library and nerd's state root, at most four levels down and among its first 2000 entries, denies what it points to, and so does a denied file or folder that is a link, even to something not yet there, unless the target is your home folder or above it, or a device such as /dev/null (how MySQL turns its history off). These rules are fixed when nerd reads the plugin's manifest, so a link added later counts after Reload plugins and agents. A history kept anywhere else (another HISTFILE, ZDOTDIR or XDG_DATA_HOME) is readable.”

A plugin’s page shows four rooms: what it shows in nerd, your files, the network and coding agents. A room it may enter is lit and says what it may do there; the others say walled off. nerd shows the same before it installs anything, and installs nothing until you say yes.

A plugin that only shows things is checked automatically and marked checked. Every other plugin, and any release that may do more than the one before, is read by the catalog’s maintainer and marked reviewed. How review works.

nerd installs a plugin’s newer release only when you ask for it, and asks again when that release can do more than the one before. A release the catalog revokes is turned off, or you are warned, depending on how it was revoked.