Plugin permissions and security

Plugins may read files, run programs, or connect to external services. Before installing or upgrading, check that these actions fit your needs.

Before installation

1. Check the publisher, version, signature, and requested permissions. Install only plugins you trust.
2. Limit access to the people and workspaces that need the plugin.
3. Put API keys, passwords, and other credentials in dedicated secret fields, not ordinary settings, chat examples, or plugin packages.
4. Disable unused plugins. Save any data you need before uninstalling.

Direct actions in plugin views use your account permissions and do not enter the AI approval queue. Approving an AI task cannot expand your account's permissions.

Shared accounts and data

Account connections and data within one installation are usually shared by authorized users. They are not automatically separated by user or workspace. Check who has access before connecting accounts or saving data.

Data survives upgrades, disablement, and restarts, but is deleted on uninstall. Authorized users may read public plugin files or import them into workspaces. Keep credentials and private content out of those files.

Before connecting an external chat

QQ and similar integrations send workspace conversation results to the bound group or private chat. The external platform may also store these messages.

• Check before confirming: Binding and member codes only start an application; confirmation in Panel is required. Verify identities rather than relying on nicknames or group names.
• Approve each member: Binding a group does not authorize everyone in it. Other members must apply separately.
• Check the permissions: Tasks follow the assigned member permissions. Invite only trusted people and remove access when it is no longer needed. The assistant may also use the owner's personal memory in replies; use a dedicated binding account and remove memories that should not be shared.
• Approve in the right place: Only the binding owner or the corresponding task initiator can answer related approvals and questions. Return to Panel for operations requiring additional identity verification.
• Closing the browser does not pause reception: Pause or revoke the binding, remove members, or disable the plugin to stop access.

Where plugins run

Plugin views and local programs have no separate security sandbox. Local programs run as the Panel service account and may access host files and networks available to that account. Displayed remote-connection restrictions do not limit everything a local program can do.

Developers must handle credential separation, network limits, and filtering of sensitive results. See Develop a plugin.