plugin-system

This code is a conventional plugin manager, but discovery immediately executes every matching Python file and plugin construction and execution also run plugin-controlled code. It has no sandbox or authenticity checks, so an untrusted or compromised plugin can act with the privileges of the host process; only load plugins from a trusted directory. No explicit credential theft, network exfiltration, or destructive behavior appears in the provided code. Severity is context-dependent and is significant when the plugin directory is writable by untrusted parties.