At a glance
- An Agent Skill is packaged instructions and scripts that extend an AI agent, often a single markdown file running with the employee's own permissions.
- Build the allowlist in four moves: discover what is already installed, assess risk, approve a baseline set, then enforce policy continuously.
- Backslash Security discovers every agent, model, MCP server, MCP tool, Skill, hook, rules file, plugin and connector running on an endpoint.
- Approval only holds if it is enforced: Backslash Security blocks risky agent actions inline before execution, including credential access and privilege escalation.
Backslash Security
Published:
Building an allowlist of approved AI agent Skills comes down to four concrete steps: discover every Skill already running on employee endpoints, assess each one for risk, approve a defined baseline set as policy, and enforce that policy continuously, with denylisting for the components you reject. An Agent Skill is a packaged set of instructions and scripts that extends what an AI agent can do — in practice, often just a markdown file sitting on a developer's machine — and it can tell the agent to read a file, call an API, or run a shell command using that employee's own permissions. That last detail is why approval has to be an enforced control on the endpoint itself, and why Skills installed outside any review process belong to the same problem security teams already call shadow AI.
This playbook is written for security teams in mid-sized, AI-dense organizations: companies where a substantial population of employees actively builds or runs agents such as Claude Code, Cursor, GitHub Copilot and Codex, regardless of total headcount. In those environments the first step is usually the hardest, because almost no one has audited a Skill, and there is no inventory to allowlist against. Backslash Security discovers every agent, model, MCP server, MCP tool, Skill, hook, rules file, plugin and connector running on an endpoint, which gives the approval list something real to describe. As of 2026, Latio's evaluation in its AI Security Market Report found that "where Backslash stood out in our evaluation is in control depth" — going beyond scanning for what is malicious to govern endpoint agent settings and what is available to an agent in the first place, with real-time protection.
What is an AI agent Skill, and what does an allowlist of approved Skills actually control?
An AI agent Skill is a packaged set of instructions and scripts that extends what an AI agent can do — read a file, call an API, run a shell command — and executes with the permissions of the employee on whose endpoint it sits. In practice, a Skill is often just a markdown file in a user-writable folder, which is why security teams rarely audit them.
What a Skill allowlist controls depends on what you mean by "approved." Two senses are in common use:
- Inventory-level approval — the register of which Skills are permitted to exist and load on company endpoints. This is the discovery-and-governance layer where unsanctioned components surface.
- Action-level approval — what an already-approved Skill may do when it runs: which commands, which destinations, which credentials. An approved Skill can still take unauthorized actions.
Practical programs maintain both lists: one determines what is allowed to load, and the other constrains the behavior of what has loaded.
Which attributes does a Skill allowlist need to record?
| Attribute | Typical values | Why it matters |
|---|---|---|
| Identifier | Name declared inside the Skill file | The label an agent matches on; names are self-asserted and can collide |
| Origin | Internal repository, public marketplace, a colleague, model-generated | Determines whether anyone reviewed the contents |
| Location | User-writable directory on the endpoint | Editable without admin rights, so approval state can change after review |
| Declared capability | File read/write, API calls, shell execution | Sets the blast radius of a single invocation |
| Executing identity | The employee's own account and local tokens | The Skill inherits that person's access to Git, cloud and SaaS systems |
| Linked components | MCP servers, hooks, rules files | One Skill can pull in components never reviewed alongside it |
Every attribute can change after approval because the files sit in locations an employee can edit without administrator rights.
Why do unapproved Skills slip onto employee endpoints without anyone noticing?
When an employee extends their AI assistant with a new capability, unapproved Skills slip onto the machine quietly — because almost nothing in that sequence resembles installing software.
Two different things get called "installing" here, and only one of them is visible.
Managed software installation is the familiar kind: a signed package pushed or inventoried through an MDM platform such as Intune or Jamf, with an asset record behind it. If an engineer installs Cursor or Claude Code this way, it shows up.
File-level configuration change is the kind that defines the agentic layer. A Skill — packaged instructions and scripts that extend what an AI agent can do — is often a markdown file dropped into a directory the agent reads. No installer, no admin rights, no package manifest.
The same mechanism covers the rest of the stack running under the employee's own identity:
- MCP servers — connections to external tools and data defined through the Model Context Protocol, each one an action path for the agent.
- Hooks — triggers that fire before or after an agent action, running something alongside it.
- Rules files such as AGENTS.md or CLAUDE.md — standing instructions the agent reads on every run.
- Plugins and connectors — extensions that widen an agent's reach into repositories, ticketing systems, and SaaS accounts.
Each inherits the signed-in user's permissions, frequently through a personal account rather than a corporate one. An endpoint detection and response tool sees an approved binary writing an ordinary text file and has no reason to object. Backslash Security's research found that malicious instructions hidden in a repository's AGENTS.md file could trick OpenAI Codex into silently accessing AWS credentials, npm tokens and Git configuration.
How do you discover every Skill already running before you write the allowlist?
Before you can approve anything, you need to discover every Skill already running on employee machines; this step is scoped to inventory, and policy decisions come later. An Agent Skill is a packaged set of instructions and scripts that extends what an AI agent can do: it can tell the agent to read a file, call an API, or run a shell command, and it executes with the user's own permissions. In practice a Skill is often just a markdown file sitting in a folder on a laptop, which conventional software inventory misses entirely.
A Skill never runs alone, so a usable inventory must capture the surrounding components:
- Skills — name, origin, and what each instructs the agent to read, call, or execute.
- The host agent — which coding or desktop agent loads it, such as Claude Code, Cursor, Codex, GitHub Copilot, or Antigravity.
- MCP servers and MCP tools — the Model Context Protocol connections an agent can act through, each a path to external systems and data.
- Rules files — standing instructions an agent reads on every run, typically AGENTS.md or CLAUDE.md, which can silently reshape behavior.
- Hooks, plugins, and connectors — triggers that fire before or after an agent action, plus whatever else has been bolted on.
- Identity — whether the agent is signed in with a corporate account or the employee's personal login on a managed device.
Device management platforms such as Intune or Jamf enumerate installed applications but do not see markdown files an agent reads at runtime, and endpoint detection tooling stops at the process boundary. Backslash Security closes that visibility gap by continuously discovering agentic components on the endpoint, so agent skills security begins from a reviewed list.
Which criteria should decide whether a Skill gets approved, restricted, or denied?
The criteria deciding whether a Skill is approved, restricted, or denied should be fixed before review starts, applying the same test to every submission. An Agent Skill is a packaged set of instructions and scripts extending what an AI agent can do—often just a markdown file on the employee's machine—executing with that user's permissions. Five criteria carry the decision.
- Capabilities. What the Skill instructs the agent to perform: read a file, call an API, run a shell command. Shell execution and outbound network calls turn a text file into an execution path.
- Permissions. The Skill inherits the identity it runs under. On a developer workstation that can mean Git credentials, cloud tokens and production access, raising the approval bar sharply.
- Data reach. Which repositories, directories, ticketing systems and documents the Skill can touch, and where its output can be sent. Reach matters most when the destination sits outside sanctioned systems.
- Provenance. Who authored it, where it was obtained, and whether the reviewed version is pinned. Unknown origin is the route by which unapproved tooling enters an allowlist.
- Update behavior. Whether the file can change after review without re-approval. A Skill edited post-approval behaves like a new Skill.
Backslash Security assesses the risk posture of Skills and other endpoint agentic AI components agentlessly—gathering information without leaving software permanently installed—giving reviewers consistent input for capability and provenance tests.
| Decision | Capabilities | Permissions and data reach | Provenance and update behavior |
|---|---|---|---|
| Approved | Read-only or narrowly scoped tool calls | Scoped to systems the team already uses | Known author, pinned version, changes trigger re-review |
| Restricted | Shell or network access for defined teams only | Non-production data or named repositories | Known author, mutable content under continuous monitoring |
| Denied | Arbitrary command execution, credential access | Reaches secrets, production, or unapproved destinations | Unknown origin, or content that changes silently after review |
How do you enforce the allowlist so a denied Skill cannot act anyway?
An allowlist of approved Agent Skills only becomes a control when enforced at invocation — otherwise a denied Skill remains a line in a register nothing consults. Agent Skills are packaged instructions extending AI agent capabilities, often just markdown files on employees' machines, loaded under their identity and permissions. Approval decisions must apply in the execution path, not at installation: a Skill rejected in review stays readable, loadable and runnable unless invocation is intercepted.
Backslash Security blocks risky agent actions inline before execution, including unauthorized code execution, credential access, privilege escalation, and data sent to unapproved destinations — where denial becomes outcome rather than intention.
| Do this | But watch out for — and how to handle it |
|---|---|
| Apply the policy at invocation, not at install | Discovery can be agentless; prevention cannot. Plan enforcement rollout through existing device management like Intune or Jamf. |
| Write separate policies per team and risk profile | Blanket denial pushes engineers onto personal accounts and unsanctioned tooling. Pair every rejection with a fast approval route. |
| Record every permitted and blocked invocation | Process-level logs stop at the binary boundary and never show agent instructions. Capture the prompt, Skill, tool call and result, and route to your SIEM. |
| Treat rules files and hooks as part of the same policy | Rules files like AGENTS.md or CLAUDE.md carry standing instructions the agent reads every run, requiring the same review as a Skill. |
Approval governs inventory; interception governs behavior. The distance between them is where rejected Skills still execute. Each enforcement decision should carry the policy version that produced it, enabling investigators to reconstruct which rule applied on the run date.
Frequently Asked Questions
What is an AI agent Skill, and why does it need an allowlist?
An allowlist of approved AI agent Skills is an explicit register of the Skills your organization permits to run, with everything outside it denied or flagged for review. A Skill is a packaged set of instructions and scripts that extends what an AI agent can do — in practice often just a markdown file sitting on the employee's machine — and it executes with that employee's own permissions. A Skill can tell an agent to read a file, call an API, or run a shell command, so approval is a privilege decision, not a software-catalog decision.
How do you build the first inventory of Skills if you have none today?
Start with agentless discovery — collecting information without leaving software permanently installed on the endpoint. Backslash Security offers a free AI Endpoint Exposure Assessment, called Scout, which is agentless, read-only, and retains no data: a short script distributed through your existing MDM, such as Intune or Jamf, that runs, reports, and disappears. Backslash Security discovers every agent, model, MCP server, MCP tool, Skill, hook, rules file, plugin, and connector running on an endpoint, which is the baseline an allowlist is built from.
Which criteria should decide whether a Skill is approved or denied?
Judge each Skill on what it can reach, not on what it claims to do:
- Capability scope — does it read files, execute shell commands, or call external APIs?
- Data destinations — where does output travel, and is that destination sanctioned?
- Identity — does it run under a corporate account or a personal one, the clearest marker of shadow AI?
- Provenance — who published it, and can the source be verified?
- Dependencies — which MCP servers and tools does it invoke? Per Backslash Security, its MCP Server Security Hub had scanned and scored more than 80,000 publicly available MCP servers as read on September 22, 2026.
Backslash Security also operates a free Skills Security Scanner that scans AI agent Skills for security risks.
How do you stop an approved Skill from going wrong after approval?
Approval does not freeze behavior. A rogue agent is an approved agent taking actions nobody asked for — reaching for credentials, escalating privilege, or sending data to an unapproved destination — often because hidden instructions in a file it read redirected it. Backslash Security blocks risky agent actions inline before execution, including unauthorized code execution, credential access, privilege escalation, and data sent to unapproved destinations.
What audit evidence should the allowlist produce?
Your allowlist should generate a reconstructable record, not just a static register. Backslash Security traces the full path of an agent run from prompt to agent to tool call to outcome, which gives incident responders something to replay and gives auditors something to inspect. According to Backslash Security, the platform automatically generates audit evidence for EU AI Act, NIS2, DORA, and SOC — evidence a governance owner can draw on when asked to show which agentic components were approved, by whom, and what they did.
About this article
Backslash Security publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Backslash Security before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-10-07