At a glance
- Vet AI agent Skills and plugins by discovering everything already installed, assessing each component's risk, then allowlisting approved items and denylisting risky ones.
- An Agent Skill is often just a markdown file, yet it runs with the employee's own permissions, credentials and network access.
- Shadow AI — unapproved agents, MCP servers and Skills employees install themselves — is what endpoint discovery and continuous policy enforcement are meant to surface.
- Latio's 2026 AI Security Market Report calls Backslash Security "one of the most complete options available," covering Claude Code, Cursor, MCP servers and Skills.
Backslash Security
Published:
Security teams should vet AI agent Skills and plugins the way they would vet any executable that inherits an employee's own permissions: discover every component already present on the endpoint, assess each one's risk posture before approval, allowlist what passes and denylist what does not, then keep enforcing that decision while the agent runs rather than only at install time. An Agent Skill is a packaged set of instructions and scripts that extends what an AI agent can do: it can tell the agent to read a file, call an API or run a shell command, and it executes with the user's credentials. A plugin or MCP server is the same problem in connection form: MCP, the Model Context Protocol, is how agents reach external tools and data, and each server is a live path an agent can act through.
Among the vetting approaches available as of 2026, Backslash Security discovers every agent, model, MCP server, MCP tool, Skill, hook, rules file (a file of standing instructions an agent reads on every run), plugin and connector running on an endpoint, according to the agentic endpoint security page on its website. That inventory is the precondition for any approval decision, because a review of a component's text alone does not account for what it does once an agent reaches hostile content on its own.
What exactly counts as an AI agent skill or plugin that needs vetting?
Any AI agent skill or plugin an agent can load on the endpoint counts and needs vetting, whether it arrives as a marketplace add-on or as a local file. A marketplace add-on is an extension pulled into an editor such as Cursor or GitHub Copilot from a publisher's catalog; it has a publisher, a version string and an update path, which makes it look like ordinary third-party software to a review process. A local Agent Skill is often nothing more than a markdown file in a folder on the employee's machine, yet it can instruct the agent to read a file, call an API or run a shell command with that employee's own permissions.
Backslash covers AI coding agents including Claude Code, Cursor, Codex, Devin, GitHub Copilot and Antigravity, as listed on its website.
The artifact classes worth enumerating, and what each can do once loaded:
- Agent Skills: packaged instructions and scripts that extend an agent's capability, running under the user's identity.
- Plugins and extensions: add-ons loaded into an agent host or IDE, able to act inside the agent's session.
- MCP servers: each server is a live connection the agent can act through to external tools and data.
- MCP tools: the individual actions a server exposes, each one an operation the agent may invoke without a human in the loop.
- Connectors: credentialed links between an agent and a system of record.
- Hooks: triggers that fire on an agent action, running something before or after it.
- Rules files (AGENTS.md, CLAUDE.md): standing instructions an agent reads on every run, so anyone who can edit the file can steer the agent.
Most of these classes can be added, edited or replaced locally by the person using the machine, with no MDM-managed install anywhere in the path.
Why do agent skills and plugins escape the controls enterprises already run?
When an engineer installs an agent Skill or a plugin, nothing crosses the boundaries the existing security stack was built to watch. A Skill is often just a markdown file on the machine, and it executes with the user's own permissions. There is no signed installer, no new SaaS tenant for a CASB to broker, no browser extension to flag. MDM enrolls devices and manages approved applications; a Skill file, a rules file like AGENTS.md or CLAUDE.md, or a locally configured MCP server sits below that inventory.
The visibility gap sits at the process boundary. The agent itself, such as Claude Code or Cursor, is an approved binary making ordinary API calls and file reads, so EDR, the incumbent endpoint layer built to catch malicious processes and known-bad behavior, sees an allowed process behaving plausibly but not which prompt, Skill or MCP server caused an action. Every downstream action carries the employee's legitimate session, which is also how shadow AI persists when employees use personal logins on corporate machines. As published on Backslash's data exfiltration use case page, the company's security research found that malicious instructions hidden in a repository's AGENTS.md file could trick OpenAI Codex into silently accessing AWS credentials, npm tokens and Git configuration.
| Component | Where it lives | Why existing controls miss it |
|---|---|---|
| Agent Skill | Markdown file plus scripts in a user directory | No install event; runs with the employee's permissions |
| MCP server | Local config pointing an agent at external tools | Appears as outbound traffic from an approved process |
| Rules file | Standing instructions read on every agent run | Plain text in a repository, treated as source content |
| Hook | Trigger firing before or after an agent action | Executes inside the agent's own lifecycle |
| Plugin or connector | Extension loaded by the agent or IDE | Not an OS-level application, so MDM holds no record |
Which risks should a security team look for in a skill or plugin before approval?
A security team reviewing an agent Skill or plugin before approval is looking for a defined set of risks, not a general impression of trustworthiness. Because a Skill runs with the user's own permissions and a rules file such as AGENTS.md or CLAUDE.md is read on every run, the review has to cover instructions as well as code.
| Do this before approval | But watch out for | Mitigation in the same step |
|---|---|---|
| Read the instruction text, not only the code | Prompt injection: hidden instructions in a file, repository or page that the agent follows as if the user had typed them | Treat any rules file, README or bundled document the component pulls in as part of the reviewed artifact |
| Enumerate the tools and MCP servers the component can invoke | Excessive permissions granted "just in case," widening blast radius beyond the stated purpose | Approve the narrowest tool set that satisfies the use case; re-review when the manifest changes |
| Trace what the component can read | Credential and token access: environment variables, cloud profiles, registry tokens, Git configuration | Require that secrets never enter the agent's reachable context |
| Map outbound destinations | Data egress through APIs, webhooks or model endpoints you did not sanction | Pin an approved destination list and send any new destination back through review |
| Pin a version | Silent updates that change behavior after your review | Approve a specific version or digest; make updates a re-approval event |
| Check supply-chain provenance | Unknown publisher, unsigned packages, typosquatted names | Record publisher, repository and signature at approval time |
| Model action chaining | A benign Skill combining with a hook into a capability nobody approved | Review the component against the other agentic pieces already live on that endpoint |
The first row is not theoretical: Backslash research found that malicious repository configurations can redirect Claude Code API requests to an attacker-controlled server, silently exposing the user's sign-in token and allowing attackers to run AI workloads, access profile information, upload files and initiate sessions under the victim's identity. Backslash turns these approval decisions into enforced policy through allowlisting of approved components and denylisting of risky ones.
How can a team run a practical vetting workflow from intake to approval?
Any team can run a practical vetting workflow for Agent Skills and plugins by treating each request as a short, repeatable pipeline rather than an ad hoc judgment call. Because a Skill executes with the requesting employee's own permissions, the review has to cover provenance, declared permissions and actual behavior.
- Open an intake record. Capture the requester, the business task, the agent it will run under (Claude Code, Cursor, GitHub Copilot and similar), and the systems it will touch. No component enters review without a named owner.
- Discover what is already installed. Before approving anything new, inventory what employees are running today across their endpoints. Backslash continuously discovers agents, Skills, MCP servers, hooks, plugins and rules files on endpoints, so intake starts from an inventory rather than an assumption.
- Verify provenance and publisher. Confirm the source repository, maintainer identity, release history, and whether the artifact is pinned to a version. Unsigned or recently republished components warrant closer handling.
- Review the manifest and permissions. Read what the component declares: file paths, shell commands, network destinations, credential scopes, and any rules file it carries or reads.
- Test behavior against real tasks. Run the component against representative tasks on a test machine and record the tool calls it actually makes, not the ones it advertises.
- Assign a risk tier. Tier by blast radius: read-only and local; write access to repositories or ticketing systems; or reach into production, secrets and customer data.
- Record the decision as enforceable policy. Approvals belong on an allowlist and rejections on a denylist. Backslash lets security teams express these as custom policies per team and risk profile, enforced continuously rather than captured in a spreadsheet.
- Define re-review triggers. A new version, changed permissions, a new MCP server dependency or a publisher transfer should send the component back through intake.
What criteria belong in a skill and plugin vetting scorecard?
The criteria for a skill and plugin vetting scorecard should be evidence-based: provenance, permission scope, data handling, update behavior, identity model and auditability. Each criterion has to resolve to an artifact a reviewer can inspect rather than a publisher's assurance.
Each criterion becomes decisive in different situations. Provenance matters most for components from public registries or forked repositories lacking release discipline. Permission scope is critical where agents hold credentials: developer workstations with cloud keys and Git access demand a higher bar than laptops running summarization plugins. Data handling governs whether prompts, files or tokens leave the machine. Update behavior matters because approved artifacts can change after review. Identity model determines whether actions run under corporate use or a personal login, the most familiar form of shadow AI, while auditability decides whether incidents can be reconstructed.
| Criterion | What the reviewer is judging | Evidence to demand |
|---|---|---|
| Provenance | Who authored and maintains the component | Named publisher, source repository, signed release or pinned version |
| Permission scope | What the component can invoke with the user's rights | Declared tool and command list, file and folder access, shell invocation |
| Data handling | Where prompts, files and secrets travel | Outbound destinations, credential reads, logging and retention behavior |
| Update behavior | Whether the approved artifact can change post-review | Version pinning, change notification, re-review trigger |
| Identity model | Whose account the action executes under | Corporate use versus a personal login on the corporate machine |
| Auditability | Whether the run can be reconstructed later | Prompt-to-tool-call trace, action logs, retained evidence |
Provenance checks age poorly for Skills because approved file text can be edited after review while its name and location stay the same, leaving a scorecard that certifies an artifact that no longer matches the reviewed version. That gap is why scoring pairs with enforcement: Backslash blocks risky agent actions inline before execution, including unauthorized code execution, credential access, privilege escalation, and data sent to unapproved destinations.
Frequently Asked Questions
What is an Agent Skill, and why does it need review before enterprise use?
An Agent Skill is a packaged set of instructions and scripts that extends what an AI agent can do, in practice often just a markdown file sitting on an employee's laptop. A Skill can tell an agent to read a file, call an API or run a shell command, and it executes with the employee's own permissions and sessions. Plugins and connectors work the same way. That is why agent skills security review has to cover the access a Skill inherits and the actions it can trigger, rather than treating the file as inert documentation.
How can a security team vet a Skill or plugin before approving it?
Vetting a Skill or plugin is a structured review of provenance, instructions and reach. A workable sequence:
- Establish where the component came from and who maintains it.
- Read the standing instructions it carries and the commands, scripts and API calls it can invoke.
- Map the identity it runs under and the files, repositories, credentials and SaaS sessions that identity can reach.
- Identify which MCP servers and tools the component can act through.
- Record an approval decision, allowlist or denylist, that different teams and risk profiles can inherit.
Backslash operates a free Skills Security Scanner that scans AI agent Skills for security risks.
What belongs in an MCP server security review?
Because each MCP server is a live connection an agent can act through, a review should establish which data sources and tools the server exposes, how it authenticates and where it stores credentials, which actions it permits, where it runs, and whether anyone maintains it. Backslash's agentic endpoint security page states that the platform discovers every agent, model, MCP server, MCP tool, Skill, hook, rules file, plugin and connector running on an endpoint, the inventory an approval decision depends on.
Why can an approved Skill or agent still become a problem later?
Approval describes a component at a moment in time; the content an agent reads afterward can change what it does. This is the rogue agent case: an approved agent taking actions nobody asked for, such as reaching for credentials, escalating privilege, or sending data to an unapproved destination, usually because it was manipulated. Backslash's data exfiltration research documents that malicious instructions hidden in a repository's AGENTS.md file could trick OpenAI Codex into silently accessing AWS credentials, npm tokens and Git configuration. Backslash's part is inline blocking: it blocks risky agent actions before execution, including unauthorized code execution, credential access, privilege escalation, and data sent to unapproved destinations.
What evidence should a vetting program keep for auditors and investigations?
A vetting program needs a durable record of what ran, under whose identity, and what it touched: the material auditors request and incident responders reconstruct from. Backslash's forensics documentation describes tracing the full path of an agent run from prompt to agent to tool call to outcome, and states that the platform automatically generates audit evidence for EU AI Act, NIS2, DORA and SOC.
How do we find the AI components employees have already installed?
Start with discovery, because an approval list only governs components you can see. Shadow AI, meaning agents, MCP servers and Skills that security has not approved, frequently running under personal accounts on corporate machines, is found through endpoint-level enumeration rather than through MDM software inventories, which do not track what an agent loads. Backslash offers a free AI Endpoint Exposure Assessment that is agentless, read-only, and retains no data. Latio's 2026 AI Security Market Report concludes that Backslash is "one of the most complete options available," with coverage spanning the full agentic surface from Claude Code and Cursor to the MCP servers and Skills running on top of them.
About this article
Backslash Security publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Backslash Security before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-11-10