There is a Custom Overrides system for avatar animations. However, this system is quite limited. It only lets you override the game's animations. It does not let you change how these animations work, or how they interact with each other. You are stuck with the default "flow". If you want to make longer hand gestures or have them separated between your left/right hand for example, this is not possible.
I propose a solution to this problem: give us access to our own Animator controllers. Add an extra option in the Avatar Descriptor component that allows us to specify our own Animator controller entirely.
The VRChat SDK already contains a sample asset, called "AvatarControllerTemplate". This seems to be a fully functional Animator controller, but with all the animations replaced with placeholders. As you can see here, this animator controller seems to contain all the necessary parameters to make it work within the game: https://i.imgur.com/DnUofXG.png
These parameters are set by the game itself. They tell the animator which direction we are moving in, which gestures are being pressed, etc. With our own animator controller, we could let our avatar freely interpret these parameters in any way we want. There are many possibilities, all we need is access to our own controllers.
To sum up, here are some possible things we could do with our own custom animator controllers:
* Separate gesture overrides between left/right hand, giving us 7 more gesture slots
* Make gesture overrides longer than 2 frames
* Add animations for landing from a jump
* Add more different walking animations
* Add AFK animations
* Add spawn animations (animations that trigger once after loading)
* Use emotes and/or gestures to make advanced state machines
As for security issues, generic rigged avatars already have custom animator controllers. Therefore, giving them to Humanoid avatars should pose no extra risk. Generic rigs are very limited in their own ways, and they do not work well with VR. Therefore, I would like to see custom animator controllers being supported on humanoid avatars.