Official vs community plugins vs Hub: 3 boundaries

Official, community, and Hub are three roles, not three quality tiers. One is the vendor, one is the ecosystem, and one is indexing; mixing responsibility leads to wrong trust.

Three roles

Clarify who maintains what.

Official means the vendor publishes and maintains. It usually comes from the vendor organization and follows release support (source).

Community means individual or third-party. Maintenance depends on the author; quality varies.

Hub means indexing. It helps discovery and installation but does not audit or endorse (source).

What "official" actually covers

Official is narrow and specific.

1. Official plugins: from the vendor organization, usually documented and supported.
2. Official docs: installation and configuration instructions from the vendor.
3. Official repository: source of truth for code and issues.
4. Not official: community plugins, third-party markets, tutorials.

A plugin included in the built-in market is not necessarily official. Inclusion and maintenance are separate; check the owner.

Domain names are not proof. A site resembling an official one does not become official; check the repository organization.

What Hub does and does not do

Hub is an entry, not a guarantor.

1. Does: aggregate plugins, provide categories and search, offer install commands.
2. Does: index metadata such as source and version.
3. Does not: audit code, guarantee maintenance, or provide support.
4. Does not: take responsibility for plugin behavior.

Inclusion is discovery, not endorsement. Treat inclusion as a candidate list, then verify source and permissions.

Hub sync lags. Version and status may differ from the repository; the repository prevails.

Responsibility boundary

When something goes wrong, who responds.

1. Plugin bug: the maintainer; open an issue in the source repository.
2. Install failure: check market metadata, then the source.
3. Data loss: the plugin and your backup policy; the market does not back up.
4. Security incident: plugin maintainer and your own controls.

The market does not provide support. It helps you find; responsibility stays with the publisher and user.

Backups remain your responsibility. No market protects your data.

Three checks

Before installing any plugin, three checks.

1. Owner: organization or individual, and whether it matches the official source.
2. Source: npm package or GitHub repository, and whether it is reachable.
3. Permissions: what the plugin requests and whether it is reasonable.

All three are about "who and what," not "where it was found." Market name is the weakest signal.

For sensitive environments, add isolation. Test in a separate profile or container.

Common misreads

Three widespread beliefs.

1. "On the Hub means official." No; it means indexed.
2. "Official means no bugs." No; official plugins can have bugs but follow support channels.
3. "Community means unsafe." No; many are high quality, but you must assess.

All three replace assessment with labels. Labels are starting points, not conclusions.

Practical advice

Use labels to decide how much to check.

1. Official: still check version and permissions.
2. Community: check owner, source, and recent maintenance.
3. Hub indexed: use as discovery, verify separately.
4. Unknown source: do not install.

Trust is layered. Labels shorten the path; they do not replace verification.

Record sources in documentation. Troubleshooting and audits depend on it.

Next steps

Role, responsibility, checks. For name variants, read dsh plugin name variants. For market terminology, read market vs marketplace vs hub. For plugin sources, read Plugin sources: index, repo and update.

Sources: DSH Plugin Hub plugin page, DeepSeek Harness docs - Packaging plugins, dsh CLI README