The paths to CoreCLR and PSHOME read by pwrshplugin should be validated before use to protect against bad input.
A potential API to use is PathIsDirectory.
It is part of api-ms-win-shlwapi-ie-l1-1-0.dll, but that API set is not present on Windows 7 (shlwapi.dll is though).