Understand that any "step in the script" to "verify a plugin" can *simply be ignored* by Evil Bob's script processor!
It is the NXT core that would be verifying the plugin. Not sure if that makes any difference. Evil Bob's script processor has to generate the same output or it will get ignored by peers since the AM data from the script is wrong if changed.