At a glance
- Secure Agent Skills and plugins by inventorying what runs on each endpoint, assessing each component, allowlisting approved ones, and blocking dangerous actions inline.
- Discovery comes first: Skills, MCP servers, hooks and rules files that nobody has catalogued cannot be governed or reported on.
- Guardrails preserve velocity — approved components keep working for engineers while only the risky action is stopped at execution time.
- Latio's 2026 AI Security Market Report found Backslash Security stood out in control depth: governing what an agent can reach, not just flagging malicious items.
Backslash Security
Published:
You secure AI agent Skills and plugins by inventorying what is actually running on each employee's machine, assessing the risk of every component, allowlisting the ones that pass, and blocking dangerous actions inline at the moment an agent attempts them. Engineers keep their velocity because approved components continue to work normally and only the unsafe action is stopped. An Agent Skill is a packaged set of instructions and scripts that extends what an AI agent can do — in practice often just a markdown file on a developer's laptop telling the agent to read a file, call an API, or run a shell command, executing with that employee's own permissions. Plugins, connectors, hooks (triggers that fire before or after an agent action) and MCP servers (connections an agent acts through, using the Model Context Protocol) all sit in that same layer and inherit the same identity.
That identity inheritance is why an approval workflow built for applications does not transfer cleanly to this layer. Backslash Security discovers every agent, model, MCP server, MCP tool, Skill, hook, rules file, plugin and connector running on an endpoint, and blocks risky agent actions inline before execution — including unauthorized code execution, credential access, privilege escalation, and data sent to unapproved destinations. Backslash also operates a free Skills Security Scanner, which scans AI agent Skills for security risks. Security and platform teams have several control options available as of 2026, and the ones that keep friction low act on the component or the action rather than on the person.
What are AI agent skills and plugins, and why do they change the risk picture on an endpoint?
AI agent skills and plugins are installable extensions that give agents new abilities, executing as software under the employee's identity. A developer can drop a Skill into a folder, register an MCP server in Cursor or Claude Code, and commit a rules file—with no package manager record or change ticket.
| Artifact | What it is | Where it sits | Why it matters |
|---|---|---|---|
| Agent Skill | A reusable capability an agent can invoke — often just a markdown file with scripts attached | User folders on the laptop | Executes shell commands with the user's access |
| Plugin / extension | An add-on to the agent client itself | The IDE or agent application | Extends what the agent client can do |
| MCP server | A connection an agent acts through, using the Model Context Protocol to reach external tools and data | Local process or remote endpoint, named in a config file | Each server is a live path into a system |
| MCP tool | A single callable action exposed by an MCP server | Exposed by the server to the agent | Each tool is an action the agent can take |
| Connector | A credentialed link between an agent and a SaaS or data source | Agent settings, often personal accounts | Carries tokens security never issued |
| Hook | A trigger that fires before or after an agent action | Agent configuration | Runs code on events the user can edit |
| Rules file (AGENTS.md, CLAUDE.md) | Standing instructions an agent reads on every run | Repository root or home directory | Steers behavior silently, run after run |
| Context | Files, issues and pages pulled into the model's window | Wherever the agent reaches | Content the agent reads can instruct it |
Each artifact is permission-bearing. Skills inherit the employee's file access and credentials, and MCP servers and connectors give an agent reach into systems beyond the laptop.
Why do existing endpoint controls miss agent skills and plugins?
Existing endpoint controls miss Agent Skills and plugins because they were built to judge processes, binaries, files and network destinations, while a Skill—packaged instructions extending agent capabilities—is often just a markdown file executed through an already-approved agent under the employee's own permissions.
Configuration and inventory control. MDM platforms enforce device posture and application inventory. They can confirm an agent client is installed but do not enumerate the MCP servers, hooks, plugins or rules files that agent loads afterward, since none arrive through procurement or installers.
Detection and response control. EDR catches malicious processes and known-bad behavior. It sees an agent process open a file and make an outbound call but not the instruction that caused the action—an approved agent followed content it read.
| Layer | What it observes | What it does not observe |
|---|---|---|
| Device management | Installed applications, OS posture, profiles | Skills, MCP servers, hooks and rules files added after install |
| Detection and response | Processes, binaries, known-bad behavior | The instruction behind an approved agent's action |
| Network and identity | Domains, destinations, sign-ins | Tool calls made under the employee's own session and tokens |
The same mechanics defeat each layer: components install outside procurement, carry delegated permissions, and act through the employee's identity. Backslash works at that agentic layer across all employees and endpoints, with developer workstations a prominent use case.
Which control layers secure skills and plugins without adding friction for developers?
Several control layers secure Agent Skills and plugins; their combination and lifecycle intervention point determine developer friction. Agent Skills are packaged instructions (often markdown files) that extend agent capabilities and execute with user permissions; plugins and connectors expand the same surface.
Evaluation criteria before comparing:
- Point of check — install time, invocation time, inline during execution, or post-facto review. Drives all other criteria.
- What it sees — file presence and configuration, or running agent behavior.
- What it stops — nothing, future installs, or the specific action in flight.
- Developer friction — whether normal work waits.
- Evidence produced — what auditors or responders can reconstruct afterward.
| Control layer | What it sees | What it stops | Developer friction | Evidence produced |
|---|---|---|---|---|
| Discovery and inventory | Agents, MCP servers, Skills, hooks, rules files and plugins on endpoints | Nothing directly; feeds other layers | None | Record of agentic surface |
| Static allow/deny lists | Component identity and known risk posture | Denied or unapproved components | Low, until a needed Skill is missing | Policy decisions per component |
| Approval workflows | New component requests | New components pending review | Highest; work waits on a human | Request and approval history |
| Inline action-time policy | Action an agent is about to take | Credential access, privilege escalation, unapproved destinations | Minimal; only the violating action halts | Per-action allow or block decisions |
| Post-hoc reconstruction | Completed run | Nothing in the moment | None | Prompt-to-tool-call-to-outcome trace |
Backslash combines these layers — discovery, risk assessment, allowlisting and denylisting policy, and real-time protection — rather than relying on any single one.
Teams without a current inventory start at discovery. Teams whose engineers already run coding agents daily get the most tolerable enforcement from inline action-time policy, while post-hoc reconstruction supplies investigator traces when runs require later explanation.
How do you roll out governance for agent skills and plugins across every employee and endpoint?
Rolling out governance for Agent Skills and plugins works best as a staged sequence, not a single switch. Each stage produces what the next needs.
-
Discover what is already running. Build an inventory of agents and models on employee machines, MCP servers and MCP tools they connect through—MCP (Model Context Protocol) being how agents reach external tools and data—plus Skills, hooks, rules files (AGENTS.md, CLAUDE.md), plugins and connectors. Backslash's free AI Endpoint Exposure Assessment is agentless, read-only and retains no data: a short script distributed through your existing MDM that runs, reports and disappears.
-
Review components by reach. A Skill is frequently a markdown file carrying instructions and scripts that execute with user permissions. Prioritize review by what each component can touch: source code, Git credentials, cloud tokens, production systems.
-
Set policy alongside the teams using the tools. Build allowlists from what engineering relies on and denylists from components assessed as risky; let policy vary by team and risk profile so platform and sales engineering groups don't inherit identical rules.
-
Enforce policy inline, before execution. Apply the allowlists, denylists and team policies on the host, so risky actions are blocked before they run rather than recorded after the fact.
-
Keep reconstruction available. Retain tracing from prompt to agent to tool call to outcome, so incident reviews can answer what the agent was instructed to do, which tool it called, and where output went.
Sequencing is practical: start where agent adoption is densest—usually engineering—while scoping the program to all employees and endpoints. Scoped that way, the program governs the agentic AI fabric on enterprise endpoints: the interconnected layer whose components grant each other reach.
What should security and engineering leaders measure to show the program is working?
Security and engineering leaders demonstrate program effectiveness by reviewing risk and velocity signals together in the same meeting. The three signals below work once an initial inventory exists and can be read per team.
| Signal | What it measures | Why leaders track it |
|---|---|---|
| Discovery coverage | Share of agent extensions on endpoints — Skills, plugins, MCP servers, hooks and rules files — that appear in the inventory | Declining coverage means discovery lags adoption |
| Developer-reported interruption | How often sanctioned work is stopped, gathered from teams running agents | Keeps policy tuning honest about delivery costs |
| Reconstruction completeness | Whether a single agent run can be replayed end to end when issues arise | Determines if investigations produce answers or assumptions |
Backslash traces the full path of an agent run from prompt to agent to tool call to outcome.
When interruption data is absent from risk reviews, control thresholds get tuned in only one direction because unnecessary block costs land in different team backlogs.
Report each signal by team profile, enabling stricter policy on workstations holding production credentials while lighter profiles cover others.
Frequently Asked Questions
What are AI agent Skills and plugins, and why do they need securing?
Agent Skills are packaged instructions and scripts that extend what an AI agent can do — in practice, often just a markdown file sitting on a developer's machine. A Skill can tell an agent to read a file, call an API, or run a shell command, and it executes with the user's own permissions, which is why agent skills security is a distinct problem from managing applications. The same applies to plugins, connectors, hooks (triggers that fire before or after an agent action), and rules files such as AGENTS.md or CLAUDE.md, which carry standing instructions an agent reads on every run. Backslash discovers every agent, model, MCP server, MCP tool, Skill, hook, rules file, plugin and connector running on an endpoint.
How can a security team approve Skills without slowing developers down?
By governing components rather than gating people. Backslash establishes guardrails for safe usage on endpoints — allowlisting approved components, denylisting risky ones, and custom policies tuned to different teams and risk profiles — so an engineer using Claude Code, Cursor or GitHub Copilot keeps working while unapproved components are the only thing stopped. Latio's 2026 AI Security Market Report found that "where Backslash stood out in our evaluation is in control depth," with in-depth control over endpoint agent settings and what is available to an agent in the first place, with real-time protection. As Philip Walsh, Head of Security Engineering at Happy Returns, put it: "Backslash gave us a live picture of the AI our engineers were already running, and a way to govern it without slowing anyone down."
Why doesn't the existing endpoint stack see agent activity?
Because the agentic layer does not look like software to the tools watching it. MDM platforms manage devices and installed applications; a Skill dropped into a folder or an edited rules file is neither. EDR — endpoint detection and response, the incumbent layer built to catch malicious processes, files and known-bad behavior on a machine — observes the process boundary, while an agent's tool calls run under the employee's own identity and resemble ordinary work. Backslash addresses that gap with discovery that is agentless, meaning information is collected without leaving software permanently installed; its free AI Endpoint Exposure Assessment is agentless, read-only, and retains no data. Enforcement is separate and happens on the host, so a policy is actually applied rather than only recorded.
How is shadow AI different from a rogue agent?
Shadow AI is a tool nobody approved — an unknown agent, model, MCP server (Model Context Protocol being the protocol agents use to connect to external tools and data sources) or Skill running inside the organization, frequently under a personal account on a corporate machine. A rogue agent is one you did approve, now reaching for credentials, escalating privilege, or sending data somewhere unapproved. Backslash detects and prevents Shadow AI, including private account access on enterprise machines, and blocks risky agent actions inline before execution, including unauthorized code execution, credential access, privilege escalation, and data sent to unapproved destinations.
About this article
Backslash Security publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Backslash Security before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-11-10