Plugins' names which contain '../', '$HOME', '%h', '..\', etc. can be dangerous. Use a sensible whitelist for plugin names and prevent its expansion.