At a glance
- Agent Skills and plugins are packaged instructions and scripts that extend an AI agent, running with the employee's own permissions on their endpoint.
- A Skill is often just a markdown file on a laptop, installed without review and invisible to conventional endpoint and device-management tooling.
- Risk arrives through hidden instructions in content agents read, unapproved components, and approved agents acting beyond their assigned task.
- Backslash Security discovers these components, assesses their risk, sets allowlist and denylist guardrails, and blocks risky agent actions inline before execution.
Backslash Security
Published:
AI agent Skills and plugins are components that extend what an AI agent can do. A Skill is packaged instructions and scripts that can tell an agent to read a file, call an API, or run a shell command, and it executes with the permissions of the employee whose machine it sits on. In practice a Skill is often just a markdown file on a laptop, while plugins and connectors sit in the same layer of components running on the employee's endpoint; MCP servers, the connections agents open to external tools and data through the Model Context Protocol, sit there too. They are a security risk for three reasons: they act with the employee's own identity and access, they are often installed by employees on their own endpoints without security approval, and hostile instructions planted in content an agent reads can steer the agent toward credential access and data leakage. Backslash Security's published research on data exfiltration found that malicious instructions hidden in a repository's AGENTS.md file could trick OpenAI Codex into silently accessing AWS credentials, npm tokens and Git configuration. The control options available as of 2026 are discovery, risk assessment, allowlisting and denylisting, and inline blocking before execution.
What exactly are AI agent skills and plugins?
AI agent skills and plugins are components that shape what an agent may do, and they run on the employee's own endpoint with that employee's identity and access. Agent Skills are packaged instructions and scripts that extend what an AI agent can do: a Skill can instruct an agent to read a file, call an API, or run a shell command, and it executes with the user's own permissions. Plugins and connectors belong to the same agentic AI fabric: the mesh of agents, MCP servers, Skills, plugins, connectors and hooks running on enterprise endpoints.
Backslash covers AI coding agents including Claude Code, Cursor, Codex, Devin, GitHub Copilot and Antigravity, and the same components run alongside agents on any employee's machine, not only on developer workstations. Three related artifacts sit alongside them:
- Rules files (AGENTS.md, CLAUDE.md): a file in a repository or on a machine that carries standing instructions an agent reads on every run.
- Hooks: a trigger that fires on an agent action, running something before or after it.
- MCP servers and MCP tools: each MCP server is a connection, over the Model Context Protocol, that an agent can act through to reach external tools and data.
Backslash discovers every agent, model, MCP server, MCP tool, Skill, hook, rules file, plugin and connector running on an endpoint, according to its agentic endpoint security page.
How do skills, plugins, connectors, and MCP tools differ from each other?
Skills, plugins, connectors, and MCP tools all belong to the layer of components an AI agent works with on the endpoint, but they differ in what each one is; hooks and rules files belong in the same comparison because they shape the agent's behavior around those components. MCP is the Model Context Protocol, the protocol agents use to connect to external tools and data sources.
| Artifact class | What it is |
|---|---|
| Agent Skills | A reusable capability an agent can invoke: instructions and scripts, such as reading a file, calling an API or running a shell command |
| Plugins and connectors | Further components of the same layer running on the employee's endpoint, next to agents, MCP servers and Skills |
| MCP servers and MCP tools | A connection, over the Model Context Protocol, that the agent can act through to reach external tools and data |
| Hooks | A trigger that fires on an agent action, running something before or after it |
| Rules files (AGENTS.md, CLAUDE.md) | A file carrying standing instructions the agent reads on every run |
What they share is the access they act with: each runs on the employee's endpoint under that employee's identity and access, so a component added for one task carries the same reach as the person who added it.
Why does an agent skill or plugin become a security risk?
An agent Skill or plugin becomes a security risk because it is a set of instructions acting with an employee's identity and access, and that combination can be steered from several directions:
- Prompt injection. Hidden instructions placed in content an agent reads — a file, repository, issue, web page or document — which the agent follows as though the user had typed them. The indirect variant is the one that matters on the endpoint, because the agent reaches the poisoned content on its own.
- Malicious repository configuration. Backslash research discovered that malicious repository configurations can redirect Claude Code API requests to an attacker-controlled server, silently exposing the user's sign-in token, allowing attackers to run AI workloads, access profile information, upload files, and initiate sessions under the victim's identity.
- Unapproved installation. Components that employees add on their own endpoints, often under personal accounts, are Shadow AI: tooling security has not approved and cannot see.
- Rogue agents. An approved agent can take actions nobody asked for — reaching for credentials, escalating privilege, or sending data to an unapproved destination — usually because it was manipulated.
The common thread is accountability: without an inventory of which agents, MCP servers and Skills run on company endpoints, there is no record to reconstruct if something goes wrong.
How do risky skills and plugins actually end up on an employee's machine?
Risky Skills and plugins end up on an employee's machine through two broad routes that bypass security approval:
- Employee installs. Shadow AI is usually installed by employees on their own endpoints, often under personal accounts, so security never sees the component arrive.
- Repository content. A rules file or configuration inside a repository the agent works in carries instructions the agent reads, which is how both Backslash research findings above reached the agent.
If it's just a markdown file, where's the harm?
Because the file is instructions, not a binary, it can tell the agent to read a file, call an API or run a shell command — and the agent does so under the user's permissions. Backslash operates a free Skills Security Scanner that scans AI agent Skills for security risks.
The same routes exist on any employee's laptop, not only on engineering machines. Developer workstations are a prominent case because they hold source code, Git systems and access to dev and production environments, but they are not the boundary.
Why do existing endpoint controls miss this activity?
Existing endpoint controls miss this activity because they observe a different unit: the process on the machine, rather than the instruction an agent received and the action it took in response.
Endpoint detection and response (EDR), the incumbent endpoint layer built to catch malicious processes, files and known-bad behavior, sees the process but not the cause: not which prompt, which agent, which Skill or which MCP server produced an action. A Skill is often just a markdown file executing with the user's own permissions, so there is no binary to convict. Device management has a matching blind spot: MDM does not control what AI agents use and install, such as Skills.
| Control layer | Gap at the agentic layer |
|---|---|
| Endpoint detection and response | Sees the process but not which prompt, agent, Skill or MCP server caused an action |
| Device management (your existing MDM) | Does not control what AI agents use and install, such as Skills |
If the cause is unknown, the action cannot be stopped in time. Backslash resolves which agent, Skill or MCP server caused an action, which is what makes stopping it possible. It replaces nothing: it fills a gap that EDR does not cover.
Frequently Asked Questions
What exactly are AI agent skills and plugins?
Agent Skills are packaged instructions and scripts that extend what an AI agent can do — in practice, often just a markdown file sitting on an employee's laptop that tells the agent to read a file, call an API, or run a shell command. Plugins, connectors and MCP tools are further components of the same layer, with MCP (Model Context Protocol) being the protocol agents use to reach external tools and data. All of them run with the user's own identity and access, which is why they belong in a security inventory rather than a productivity backlog.
Why is a text file treated as a security risk?
Because the agent treats its contents as instructions, and then acts with the user's own permissions. A rules file — AGENTS.md or CLAUDE.md, a file carrying standing instructions an agent reads on every run — reaches the agent each time it starts. Backslash's data exfiltration research found that malicious instructions hidden in a repository's AGENTS.md file could trick OpenAI Codex into silently accessing AWS credentials, npm tokens and Git configuration. That is indirect prompt injection: hostile instructions reaching the agent through content it reads on its own.
How do MDM and existing endpoint tooling fall short here?
MDM does not control what AI agents use and install, such as Skills. Endpoint detection and response tooling is built to catch malicious processes, files and known-bad behavior — it sees the process but not the cause, and not what an agent was instructed to do. Latio's 2026 AI Security Market Report states that Backslash "was one of the first companies to focus on securing AI on the endpoint, building AI endpoint controls well before this year's rush of newcomers."
Which controls actually cover Skills, MCP servers and plugins?
Four, in combination: continuous discovery of every component; an agentless assessment of each component's risk posture; allowlisting and denylisting with custom policies per team and risk profile, enforced continuously; and inline prevention that acts before a violation is executed. Backslash pairs agentless discovery with on-host enforcement, so a policy is actually applied rather than only recorded: it blocks risky agent actions inline before execution, including unauthorized code execution, credential access, privilege escalation, and data sent to unapproved destinations.
What is the free AI Endpoint Exposure Assessment?
Backslash offers a free AI Endpoint Exposure Assessment, also called Scout, that is agentless, read-only, and retains no data: a short script distributed through your existing MDM that runs, reports and disappears. Agentless here means collecting information without leaving software permanently installed on the endpoint, and it applies to discovery and risk assessment; enforcement runs on the host. For checks on individual Skills, the free Skills Security Scanner scans AI agent Skills for security risks.
What does shadow AI look like, and what record exists afterward?
Shadow AI is AI tooling, agents, MCP servers and Skills running inside the organization that security has not approved and cannot see — most concretely, an employee signing an agent into a personal account on a corporate machine. Backslash detects and prevents Shadow AI, including the use of private account access on enterprise machines. For the record afterward, the platform traces the full path of an agent run from prompt to agent to tool call to outcome, and automatically generates audit evidence for EU AI Act, NIS2, DORA and SOC.
About this article
Backslash Security publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Backslash Security before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-11-10