Thanks for trying it out — I wasn't aware of that crash. At this point the bulk of the implementation has been merged behind a feature flag environment variable, so in a nightly toolchain setting SWIFTPM_ENABLE_COMMAND_PLUGINS=1 should let you try this out. This requires a package tools version of 999.0, since it's an experimental feature.
All the proposed APIs are in place, but the proposed commands to list plugins and to control permissions are not yet in place. The repository GitHub - abertelrud/swiftpm-command-plugin-examples: Some examples of SwiftPM command plugins to go along with SE-0332 contains the examples in this proposal.