>DuckDB Labs and the DuckDB Foundation do not vet the code within community extensions and, therefore, cannot guarantee that DuckDB community extensions are safe to use. The loading of community extensions can be explicitly disabled with the following one-way configuration option:

So we should think of this like NPM.

Still, very cool and very useful. Would love a way from inside of duckdb directly to query the extensions available from community.