15 Criteria for Approving AI Plugins on Employee Laptops
Approving an AI plugin means checking provenance, identity, permissions, execution rights, data destinations and auditability before the...
A 30-Day Plan to Stand Up AI Plugin Vetting
A 30-day vetting plan runs in three stages: discover what employees already run, decide what is approved, then enforce those decisions...
Allowlist vs Denylist for AI Skills: The Real Trade-Offs
An allowlist approves a named set of Agent Skills and refuses the rest; a denylist permits by default and blocks components already...
How an AGENTS.md File Becomes an Attack Path
An AGENTS.md rules file hands an AI coding agent standing instructions on every run; anyone able to write to the repository can rewrite...
How to Approve AI Skills Without Slowing Developers Down
Approve Agent Skills through continuous discovery and allowlisting on the endpoint, instead of routing every request through a ticket...
How to Evaluate an MCP Server's Risk Before Employees Install It
Evaluate an MCP server on publisher provenance, exposed tools, inherited credentials, exposure to untrusted content, and whether you can...
How to Shortlist Endpoint AI Visibility Tools in 2026
Set shortlist criteria before vendor names: discovery depth, risk assessment, enforcement point, and the audit record a tool leaves...
How to Vet an MCP Server Before You Approve It Internally
Vetting an MCP server means checking publisher provenance, the tools it exposes, credential scope, data destinations, and behavior once...
Mistakes Security Teams Make When Vetting AI Agent Skills
Most Skill reviews are one-time file reads, yet an Agent Skill is an editable markdown file that can change after approval. A Skill...
What a Security Review of an AI Agent Skill Should Cover
A Skill review covers its instruction text, file and shell reach, the identity it runs under, its provenance, and whether its activity...
What an AI Agent Audit Trail Must Capture for the EU AI Act and DORA
An agent audit trail must record the full causal chain: prompt, agent, model, Skill or MCP server, tool calls, identity, data touched,...
Why AI Agent Skills and Plugins Are a Security Risk
Agent Skills and plugins are executable instructions that run with the employee's own identity and permissions, usually installed with...
An MCP Server Vetting Checklist for Enterprise Security Teams
An MCP server vetting checklist tests publisher provenance, exposed tools, credential handling, data destinations, and runtime behavior...
Audit Trails for EU AI Act and DORA Agent Activity
EU AI Act and DORA audit trails must reconstruct what an agent was asked, which tools it reached, and what it changed. Process-level...
Five Mistakes Security Teams Make When Vetting AI Plugins
Most AI plugin review fails at install time, then never revisits the agents, MCP servers, Skills, hooks and rules files that change...
How Often Should You Re-Vet AI Skills After They Update?
Re-vet an AI Skill on every version change, not on a calendar — a Skill is editable instructions that execute with the user's...
How to Build Allowlist and Denylist Policies for AI Agents on Employee Endpoints
Allowlist and denylist policies for AI agents only work on top of a live inventory of what employees actually run. Approve components by...
How to Design an Intake and Approval Workflow for AI Plugins
An AI plugin intake and approval workflow is a documented path from request, through security assessment, to an allowlist decision and...
How to Scan an AI Skill for Risk Before Developers Install It: A Pre-Install Review Guide for Security Teams at AI-Heavy Engineering Organizations
Treat an Agent Skill as executable code: review its instructions, scripts, commands, and reachable credentials before any developer...
How to Vet MCP Servers Before Employees Install Them
Vet each MCP server against a fixed sequence: publisher, exposed tools, requested permissions and credentials, data handling, update...
Vetting AI Agent Skills Before Approval: What Enterprise Security Teams Should Check
Vet a Skill by reading what it instructs the agent to do and which files, credentials and connections it can reach. An Agent Skill is...
Why AGENTS.md Files Belong in Your AI Vetting Process
A rules file such as AGENTS.md carries standing instructions an AI agent reads on every run, executing with the employee's own identity...
Denylist, Sandbox, or Block Inline: How to Choose a Control for AI Plugins on Endpoints
Denylisting refuses known-bad components before load; sandboxing limits blast radius; inline blocking stops a specific agent action in...
Hooks, Rules Files and Connectors: The Vetting Blind Spot on Every Endpoint
Hooks, rules files and connectors carry standing instructions nobody reviewed, and they never show up in MDM inventories or...
How to Build an Allowlist of Approved AI Agent Skills: A Playbook for Security Teams in AI-Heavy Organizations
An Agent Skill is packaged instructions and scripts that extend an AI agent, often a single markdown file running with the employee's...
How to Find Shadow AI Agents on Employee Endpoints
Shadow AI agents are AI agents, MCP servers and Skills employees install on work machines without approval, often authenticating with...
How to Set Per-Team AI Plugin Policies by Risk Profile
A per-team AI plugin policy ties the strictness of agent extension rules to what each team's agents can actually reach. Start with...
How to Vet AI Skills Without Slowing Developer Velocity
Vet Agent Skills where they run: continuous discovery, automated risk assessment, allowlisting of approved Skills, and inline blocking...
What Makes a Third-Party AI Plugin Risky on Employee Laptops?
A third-party AI plugin inherits the employee's identity, permissions and access, so it can reach whatever systems, repositories and...
What to Ask Before Approving a New MCP Server
Before approving a new MCP server, establish ownership, the credentials it inherits, the tools it exposes, data destinations, and...
How this content is made
Backslash Security publishes this hub under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Backslash Security before publication. Publication and update dates reflect substantive edits, not automated refreshes.