docs(plugins): document security and persistent data

[QIANLING-0831]

Related Issue

N/A — documentation-only clarification.

Scope

This pull request applies only to the plugin contract implemented by MoonshotAI/kimi-cli: root plugin.json, command-based tools, inject, and installation under ~/.kimi/plugins/.

It does not describe or change the separate MoonshotAI/kimi-code plugin contract, which supports kimi.plugin.json, Skills, sessionStart, MCP servers, and hooks through /plugins install.

Description

• document the trust boundary of locally executed plugin tools
• explain credential-handling precautions for inject
• clarify that reinstalling replaces the plugin installation directory
• recommend a separate data directory and explicit retention, inspection, export, deletion, and network-transmission documentation for stateful plugins
• add the same guidance to the Chinese source document and its English counterpart

Motivation

The plugin guide in this repository explains installation, command-based tool execution, and credential injection, but it does not currently document the trust boundary or how reinstallation affects plugin-owned data. These details are especially important for plugins that store sessions, source code, or user input.

The clarification is intentionally scoped to this repository's plugin implementation and should not be used to assess compatibility with the separate MoonshotAI/kimi-code plugin system.

Checklist

• I have read the CONTRIBUTING document.
• I have linked the related issue, if any. (N/A — documentation-only clarification.)
• Tests are not applicable because this is a documentation-only change.
• make gen-changelog was not run because this change does not affect the changelog.
• make gen-docs was not run; the Chinese source and English counterpart were updated directly.

Validation

• git diff --check
• documentation-only change; no runtime tests run

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[QIANLING-0831]

Please approve my application！