A team adds a new coding-agent plugin from an unknown source that can run arbitrary local commands. Which approach best fits?

1. Include boundary and failure-case validation for the affected control.
2. Review the diff against the authorized scope and remove unrelated modifications.
3. Supply concise reviewed repository guidance and relevant local examples.
4. Review provenance, permissions, and sandbox behavior before enabling it.