A warning about searching for the pattern FileManagerSecure.DeleteFile to detect potential crasher code.
While this is rather straightforward, you'll only find a subset, it's not foolproof. I'm not a c# coder but like in every language it's easy to hide the called method. If VaM allows that subset of c#, a google search shows me it takes 3 more lines to hide everything.
The only way to detect that is to run it in a sandbox or a real interpreter. In the end you're close to coding an antivirus..
As soon as an app allow arbitrary code to run, it has the potential to harm the content of the application or even escape and affect your whole system. flexibility vs security. Btw, I still vote for flexibilty, we'd loose much more by restricting the language.
Probably only MeshVR can mitigate that, like having mktemp function where your only allowed to erase files within a temp dir or whatever that covers the erase case (and maybe there are other methods)
So my advice... each time you download content, search for *.cs and *.dll (usually but not only in a Script subdir). Unless the var is clearly a plugin var (and there are not many plugin coders so there are rather known authors), a var with content (cloth, scene, ..) containg also a plugin should trigger your attention. With the var system, there shouldn't be a need to include plugins in other type of content. I'd even say, avoid it completly. With a malicious and determined user, only a very good eye can see a threat. For small code with standard non system functions, by visual inspection you can confirm the code is safe.
If somebody posts a non free plugin, even from a known creator, it might have been modified... as vars are not signed. So.. download from "known" posters..
No need to be scared, this is known for a long time that VaM runs code. It had to happen.. I am surprised it didn't happen earlier.