At a glance
- Engineers treat every Agent Skill as executable code: discover it, assess it, and approve it before it runs with a user's permissions.
- OS-level control starts with continuous discovery of agents, models, MCP servers, Skills, hooks and rules files on each endpoint.
- Backslash Security was founded to secure the agentic AI fabric on enterprise endpoints, according to the About page on its website.
- Inline blocking at the moment of execution, plus run-level tracing, gives security teams a record they can reconstruct incidents from.
- Personal-account logins and unapproved agents on corporate machines are the shadow AI problem discovery is meant to surface first.
Backslash Security
Published:
How Should Engineers Secure AI Agent Skills at the OS Level?
Securing AI agent Skills at the OS level means controlling them at the agent layer rather than the process layer alone (options available as of 2026). In practice that means knowing which Skills, MCP servers, hooks and rules files sit on each endpoint, allowlisting approved components and denylisting risky ones, and blocking a risky action inline before it executes. An Agent Skill is a package of instructions and scripts, often just a markdown file in a folder on a laptop, that extends what an AI agent can do. It runs with the user's own permissions. Endpoint detection and response (EDR) sees the process but not the cause: it does not show which prompt, agent, Skill or MCP server produced an action. Backslash Security discovers these components on employee endpoints, assesses their risk posture and enforces allowlist and denylist policies on the host.
What exactly is an AI agent skill, and why does it run with operating system privileges?
An AI agent Skill is a packaged unit of instructions and scripts that extends what an AI agent can do. In practice it is often just a markdown file in a folder on an employee's laptop. A Skill runs with operating system privileges because it executes with the user's own permissions. A Skill that tells an agent to read a file, call an API or run a shell command does so with the access that employee already holds.
The other components an agent uses on an endpoint act with the same employee's identity and access:
| Component | What it is | Why it matters to a control owner |
|---|---|---|
| Agent Skills | Packaged instructions and scripts that extend what an agent can do | Can tell an agent to read a file, call an API or run a shell command with the user's own permissions |
| MCP servers and MCP tools | Connections through the Model Context Protocol, which agents use to reach external tools and data | Each MCP server is a connection an agent can act through |
| Hooks | Triggers that fire on an agent action, running something before or after it | Something runs automatically around the actions an agent takes |
| Rules files (AGENTS.md, CLAUDE.md) | Files in a repository or on a machine that carry standing instructions | An agent reads them on every run |
Which OS-level controls are available for constraining agent Skills?
The OS-level controls available for constraining agent Skills sit at two layers. At the process layer, EDR, the incumbent endpoint security layer, is built to catch malicious processes, files and known-bad behavior on a machine. MDM manages the device, but it does not control what AI agents use and install, such as Skills. At the agent layer, the controls act on the components themselves:
- Discovery of the Skills, MCP servers, hooks, rules files, plugins and connectors on each endpoint
- Assessment of the risk posture of each component
- Allowlisting of approved components and denylisting of risky ones, with custom policies per team and risk profile
- Inline blocking of risky actions before they execute
- Audit and tracing data for each agent run
For Skills specifically, Backslash offers a free Skills Security Scanner that scans AI agent Skills for security risks.
How do you discover every skill, hook and rules file already installed on employee endpoints?
Discovering every Skill, hook and rules file already installed on employee endpoints starts on the endpoint itself, because no allowlist, denylist or inline control can cover components nobody has listed.
These components run on the endpoint with the employee's own identity and access. A Skill is often just a markdown file in a folder. A rules file such as AGENTS.md or CLAUDE.md holds standing instructions an agent reads on every run. A hook is a trigger that fires before or after an agent action. Each MCP server is a connection an agent can act through, for agents such as Claude Code or Cursor.
Backslash continuously discovers every agent, model, MCP server, MCP tool, Skill, hook, rules file, plugin and connector running on an endpoint, and it assesses the risk posture of each component with an agentless approach. The platform pairs that agentless discovery with on-host enforcement, so a policy is actually applied rather than only recorded. It also detects Shadow AI, including private account access on enterprise machines.
Why do endpoint controls designed for malware miss which agent skill caused an action?
Endpoint controls designed for malware miss which agent Skill caused an action because they work at the process layer. Detections and log routing stop at the process boundary, so the same action looks different at each layer.
What does the process layer record?
The process layer records what happens on the machine: which process ran and which files it touched. EDR works at this layer, catching malicious processes, files and known-bad behavior.
What does the agent layer add?
At the agent layer, the record covers what an assistant was instructed to do and what it then did. For example, a Skill might tell an agent to read a credential file, call an external API or run a shell command. The process layer records the agent's process acting for the logged-in employee. It does not record which Skill or rules file supplied the instruction.
Backslash works at the agent layer. It resolves which agent, Skill or MCP server caused an action, which is what makes stopping the action possible. It complements endpoint detection rather than replacing it.
What does it take to block a risky agent action inline, before it executes?
Blocking a risky agent action inline takes a control that sits in the path of the action and applies policy before it executes, instead of recording what already happened. Backslash blocks risky agent actions inline before execution, including unauthorized code execution, credential access, privilege escalation, and data sent to unapproved destinations.
That matters because an agent on an endpoint acts with the employee's own identity and access.
| Do this | Watch out for | Handle it by |
|---|---|---|
| Put the control in the path of the action | A control that only records an action after it ran | Deciding before execution, not after |
| Allowlist approved components and denylist risky ones | New Skills or MCP servers appearing between reviews | Keeping discovery continuous so policy covers what is actually installed |
| Write custom policies per team and risk profile | Rules so broad they block legitimate work | Giving each team an approved set that fits its risk profile |
| Record each decision and its context | A block nobody can explain afterward | Keeping a trace of each run from prompt to agent to tool call to outcome |
Frequently Asked Questions
What is an AI agent Skill, and why does securing it at the OS level matter?
An Agent Skill is a packaged set of instructions and scripts that extends what an AI agent can do. In practice it is often just a markdown file on the employee's machine. A Skill can tell an agent to read a file, call an API or run a shell command, and it runs with the user's own operating system permissions.
How do you find out which Skills, agents, and MCP servers are already installed?
You discover them on the endpoint itself. MCP, the Model Context Protocol, is the protocol agents use to connect to external tools and data sources, so every MCP server an employee adds is another connection an agent can act through. For a first pass, Backslash offers a free AI Endpoint Exposure Assessment (also called Scout) that is agentless, read-only and retains no data. Separately, its MCP Server Security Hub has scanned and scored publicly available MCP servers.
Why doesn't the existing endpoint stack see this layer?
EDR sees that a process ran. It does not see what an agent was instructed to do, which Skill or rules file supplied the instruction, or which MCP server the resulting tool call went through. That layer appeared between the operating system and the network when AI agents arrived, and existing tooling does not observe it.
What is a rules file, and how does it become an attack path?
A rules file is a file in a repository or on a machine, such as AGENTS.md or CLAUDE.md, that holds standing instructions an agent reads on every run. Hidden instructions placed in content an agent reads work as a prompt injection: the agent follows them as though the user had typed them. Backslash security research found that malicious instructions hidden in a repository's AGENTS.md file could trick OpenAI Codex into silently accessing AWS credentials, npm tokens and Git configuration.
How can guardrails be applied without slowing teams down?
Govern components instead of banning tools. Allowlist approved agents, Skills and MCP servers, denylist risky ones, and write separate policies for teams with different risk profiles. Backslash enforces those policies continuously on the host. As Philip Walsh, Head of Security Engineering at Happy Returns, put it: "Backslash gave us a live picture of the AI our engineers were already running, and a way to govern it without slowing anyone down."
What record should exist if an agent does something it shouldn't?
You need a path you can reconstruct, not just an alert. Backslash traces the full path of an agent run from prompt to agent to tool call to outcome, and automatically generates audit evidence for EU AI Act, NIS2, DORA and SOC. The record should also keep two problems apart. Shadow AI means tools nobody approved, including an employee signing in with a personal account on a corporate machine. A rogue agent is an approved agent taking actions nobody asked for.
About this article
Backslash Security publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Backslash Security before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-11-10