diff --git a/default/agents/skills/omarchy/plugins.md b/default/agents/skills/omarchy/plugins.md
index 6e3ab069..ce6ab3f8 100644
--- a/default/agents/skills/omarchy/plugins.md
+++ b/default/agents/skills/omarchy/plugins.md
@@ -17,6 +17,25 @@ changes. `idle.screensaver` and `idle.lock` are seconds since user idle began.
 
 **Commands:** `omarchy restart shell`, `omarchy refresh shell`
 
+## Plugin UI Safety
+
+Plugins run inside Omarchy's long-lived, unsandboxed shell. Treat text from network responses, files, IPC, settings, environment variables, and command output as untrusted.
+
+- QML `Text` defaults to `Text.AutoText`. Do not bind untrusted data to an AutoText sink: markup-shaped input such as `<img src="https://example.invalid/tracker">` can be interpreted as rich text and load a resource.
+- For display text owned by the plugin, set `textFormat: Text.PlainText`. Prefer a local `PlainText` component when the plugin has multiple text elements.
+
+```qml
+Text {
+  textFormat: Text.PlainText
+  text: modelData.name
+}
+```
+
+- When passing dynamic text to an Omarchy-owned component whose internal `Text` format the plugin cannot set, neutralize markup in the plugin first with a helper of its own, and add a regression test; Omarchy ships no such helper. Never edit the packaged component to add a plain-text option: that belongs in a pull request to Omarchy.
+- Bound and validate downloaded data before displaying or saving it: limit response and collection sizes, string lengths, identifiers, and timestamps.
+- Keep network access explicit. Use fixed HTTPS sources, timeouts, response-size limits, and validation. For periodic background refreshes, disclose the behavior and let users enable or disable it. Never execute downloaded content or interpolate untrusted values into shell commands.
+- Add regression coverage for markup-shaped input and every shared tooltip or notification sink that receives dynamic text.
+
 ## Bar Layout
 
 Use the `omarchy bar` group to move and manage widgets: