HD documents are inert data and are sanitized before rendering. Plugins are code and run inside the preview webview. Only put plugin files you trust into your plugin folders; treat them like any other dependency you add to a project.
Development
No build step is required; the extension is plain JavaScript.
Open the vscode-extension/ folder in VS Code.
Press F5 to launch the Extension Development Host.
Open any .hd file in the dev window.
Package locally:
npm run build:local
npm run install:local
Publishing
npm run package
npm run publish
Publishing requires a Visual Studio Marketplace publisher named wishlatte and a valid VSCE_PAT.