I agree that the attack surface needs to be carefuly thought about. It shoudln't be much harder than current "widgets", though. I was thinking of something tha

I agree that the attack surface needs to be carefuly thought about. It shoudln't be much harder than current "widgets", though. I was thinking of something that only does I/O with data contained in the room it's in. I think the UI would be the hard part, but it could be doable with a few HTML tags and an extensible UI. For instance: add an "insert poll" button, or an "add voice message" button. Or an "add sticker"/emoji/gif, etc. Currently every client needs to build this individually. Users could pick the features they want in their clients. Moreover, not every plugin needs to be third-party. A "trusted store" could very well be maintained.