Yeah they can be downright dangerous. Some time ago, hackers got access to a plugin on wordpress.org and injected it with malicious code. Nobody even knew until

Yeah they can be downright dangerous. Some time ago, hackers got access to a plugin on wordpress.org and injected it with malicious code. Nobody even knew until Sucuri released a blog post about it. At wpplugincheck we verify the plugin is clean by checking for any issues at wpvulndb. I'm also looking at automating plugin code testing.