Update Box plugin skills from upstream

[william-openai]

Summary

• Sync the curated Box skills from box/box-for-ai@172a8273, the artifact shared by Box.
• Add the shared legal, contract-review, client-intake, and M&A deal-room skills included in that artifact.
• Replace the previous Box skill content and stale support files with the shared skill tree, add OpenAI launcher metadata for all five skills, and bump the plugin patch version from 0.0.3 to 0.0.4.

Curated adaptations

• Remove the shared skill's dependency on the Cursor-specific root rules/box.mdc file, which is not part of the OpenAI plugin bundle.
• Replace upstream npx skills add instructions and namespaced references with links to the skills already bundled in this plugin.
• Generalize Cursor- and Claude-specific callback and setup examples to client-neutral connector/MCP guidance.
• Preserve the existing OpenAI app binding, assets, marketplace entry, plugin interface metadata, and generic Box tool-selection guidance.

Validation

• git diff --check
• JSON parsing and manifest path/version assertions for .codex-plugin/plugin.json and .app.json
• Standard skill validator: 5/5 skills valid
• Focused ingestion check: unique directory-matching skill names, launcher prompts, short descriptions, and relative links all valid
• node plugins/plugin-eval/scripts/plugin-eval.js analyze plugins/box --format markdown: 0 failures; warnings are limited to the upstream bundle's static token budget and description phrasing
• node --test plugins/plugin-eval/tests/**/*.test.js: 21 passed, 0 failed
• Provenance comparison against the pinned Box artifact: 11 of 18 upstream skill documents are byte-for-byte identical; the remaining seven contain only the packaging adaptations described above
• Focused security check: no embedded credentials, executable payloads, installer commands, or unexpected external domains

Not run

• cloud-plugin-admin catalog validate: command is not available in this checkout
• Live Box MCP/CLI smoke or eval: no Box CLI/authenticated Box session is available in the isolated checkout

[william-openai]

(William's agent) Superseded by openai/oai-maintained-plugins#271, which carries the Box skill update in the now-canonical repository. Closing this draft to avoid duplicate review.