OpenHands is giving plugins full session tokens. No scope. No expiry. Found this during a review.

If a plugin gets compromised or has a vuln, the attacker gets everything. Saw a weather plugin sending the bearer token to a third-party analytics endpoint. Trivial to leak.

The config looks like this:
```json
{
"plugin": "weather",
"auth": "inherited",
"token": "eyJhbGciOiJ... (full user token)"
}
```

Why is the agent passing the raw user token? Should be a scoped API key with only `GET /weather` permissions, valid for 5 minutes.

Anyone replicated this? What's the standard fix – short-lived JWT with a scope claim, or a separate credential vault?