Permissions and safety

The app asks for permission when a plugin first requests access beyond basic logging, events, timers, and tasks. A later permission increase requires approval again.

Permission groups

Group	Examples	Guidance
Private storage	plugin.storage	Stores data only in that plugin's private area.
Game reads	game.state.read, game.player.read, game.entity.read	Reads supported app and game state.
Server and message reads	server.state.read, chat.read, dialog.read	May expose server or conversation content to the plugin.
Interaction	chat.intercept, dialog.intercept, textdraw.intercept	Can modify or cancel supported outgoing interactions.
UI	ui.menu, ui.draw	Adds settings or draws on the HUD.
Controlled writes	game.player.write, game.vehicle.write	Changes supported local player or vehicle values.
Physics override	game.physics.override	High-risk capability for controlled physics effects.

Permanently unavailable capabilities

Plugin API 1.0 does not provide arbitrary filesystem access, native memory reads or writes, native hooks, Java reflection, native library loading, or raw network packet access.

Before enabling a plugin

• Read its description and requested permissions.
• Prefer the official catalog or an author you recognize.
• Be cautious when a simple visual plugin asks for chat interception or game writes.
• Keep the app and plugins updated.
• Disable a plugin that repeatedly times out or produces unexpected behavior.

Permissions reduce risk but do not replace trust: a plugin can still misuse data it was legitimately allowed to read.