At a glance
- Most endpoint tooling logs processes, not agent intent, so local Skill and plugin invocations leave no usable record.
- A real audit trail must capture prompt, agent, tool call and outcome as one linked sequence.
- Backslash Security traces the full path of an agent run from prompt to agent to tool call to outcome.
- Ask vendors which fields they record per invocation, and whether evidence survives an incident review.
Backslash Security
Published:
A usable audit trail of local Agent Skill and plugin invocations has to come from the agentic layer on the endpoint, because process-level endpoint telemetry records processes and files rather than agent behavior, and detections and log routing stop at the process boundary. An Agent Skill is a packaged set of instructions and scripts that extends what an AI agent can do (often just a markdown file on the machine), and it executes with the employee's own permissions, which is exactly why a process-level log cannot tell you what was invoked, by which agent, or why. Backslash Security traces the full path of an agent run from prompt to agent to tool call to outcome, according to the agentic endpoint security pages on its website, which is the shape of record an investigation needs. Among the options available as of 2026, the practical test for any platform is narrow: can it name the Skill, MCP server or plugin that ran, the agent that called it, the identity it ran under, and what the call touched, and can it hand that evidence to an auditor or incident reviewer afterward.
What counts as a real audit trail when an AI agent runs a local skill or plugin?
A real audit trail captures each invocation, not merely the process that spawned it: every time an agent runs a local Skill or plugin, the entry has to say who invoked what, under whose identity, with which inputs, against which resources, and with what outcome.
- Agent: software that plans and executes multi-step tasks through a model, such as Claude Code, Cursor or Codex.
- Agent Skills: packaged instructions and scripts that extend an agent, often just a markdown file on the machine, executing with the user's own permissions.
- Plugin / connector: an extension that wires an agent into an application or data source.
- Hook: a trigger that fires on an agent action, running something before or after it.
- Rules file: a file such as AGENTS.md or CLAUDE.md carrying standing instructions the agent reads on every run.
- MCP server: under the Model Context Protocol, a connection an agent can act through; an MCP tool is one callable function it exposes.
- Context: the content assembled into the model's prompt, including files the agent reads on its own.
Backslash discovers every agent, model, MCP server, MCP tool, Skill, hook, rules file, plugin and connector running on an endpoint, which is the inventory an invocation record is written against. Without that inventory, there is nothing to report against when an auditor asks which components were in use.
Why do existing endpoint and identity logs miss agent skill and plugin activity?
When you search endpoint and identity logs for proof an agent invoked a local Skill, the records look unremarkable because nothing unusual happened at the layer those systems watch.
On the machine, an invocation appears as an ordinary interpreter, shell or editor process launched by a binary the employee is allowed to run. In the directory, the session is that employee's normal sign-in on their normal device. The semantic layer (which agent ran, which Skill, plugin or MCP server it used, which tool call it made, and on what context) is not part of either record.
| Log layer | What it records | What it cannot reconstruct |
|---|---|---|
| Process-level endpoint telemetry | Process trees, file writes, binaries, known-bad behavior | Which agent started the process, and which Skill or plugin it ran |
| Identity and directory logs | Authentications, token issuance, group membership | That an agent, not the human, drove the authenticated action |
| SaaS and application audit logs | API calls and changes inside one application | The prompt, agent and local tool chain upstream of the call |
| Network egress records | Destinations, volumes, connection metadata | Why the agent reached that destination, and on whose instruction |
An execution record answers what ran on the host and under whose credentials, which helps incident triage on a compromised laptop. An agent-activity record answers what the agent was instructed to do and which local capability it used, for example that a coding agent read a repository rules file and then called a file-system tool. Only the second kind names the Skill or plugin.
Which fields must a platform record for an invocation to be reconstructable later?
An invocation record is reconstructable only if each call to a local Agent Skill, plugin, hook or MCP tool stays readable months later with the following fields intact.
| Evidence field | What it captures | Why it matters later |
|---|---|---|
| Endpoint and employee identity | Device identifier plus the account used, corporate or personal | Separates sanctioned use from shadow AI under a private login |
| Agent and model | Client (for example Claude Code, Cursor, Codex or GitHub Copilot) and model called | Scopes blast radius when an agent or model is found unsafe |
| Component name, version and origin | Skill, plugin, hook or rules file (AGENTS.md, CLAUDE.md), with source and revision | A Skill edited yesterday is a different Skill; the version in force is evidence |
| MCP server and tool invoked | Server identity, tool name and call made | Supports targeted MCP server security review after a disclosure |
| Trigger | Prompt, hook or chained call | Distinguishes instructed work from self-initiated work |
| Parameters and arguments | What the agent passed into the call | Distinguishes a benign read from credential access or privilege escalation |
| Data and connectors reached | Files, repositories, credentials, APIs and destinations touched | Shows whether source code or secrets left the approved boundary |
| Policy decision and outcome | Allowed or blocked, success or error, with timestamp | Shows a control was enforced, not merely configured |
Records also need stable correlation identifiers so prompt, tool call and outcome resolve into a single timeline rather than scattered events.
How do the different control layers compare on agent skill and plugin audit coverage?
Audit coverage of a local Skill or plugin invocation depends on where a control layer sits relative to the endpoint, because the Skill executes with the user's own permissions on the machine itself.
- Local invocation visibility: whether the layer records that a specific Skill, hook or plugin was called at all.
- Human identity attribution: whether the record ties the action to a named employee rather than a process or a shared service account.
- Pre-execution decision point: whether the layer can evaluate an action before it runs, which decides whether policy is enforceable or only reportable.
- Timeline completeness: whether prompt, agent, tool call and outcome reconstruct as one sequence.
| Control layer | Local Skill invocation | Human identity | Pre-execution point | Timeline completeness |
|---|---|---|---|---|
| Process/endpoint telemetry | Process-level only | Host-bound | Process-level | Fragmented |
| Identity and SSO logs | No | Strong | At sign-in | Authentication only |
| Network or proxy inspection | No | Inferred | At egress | Traffic events only |
| Server-side MCP or gateway logging | Server-side calls only | Depends on token | At the gateway | Per-connection |
| Model-provider API logs | No | Account-level | Provider-side | Prompt/response only |
| Endpoint agentic layer | At the point of invocation | The employee's identity the agent runs under | On the host, before execution | Prompt to agent to tool call to outcome |
Identity and network layers suit access and egress questions; gateway and provider logs suit server-mediated tool use; the endpoint agentic layer is the one that sees a Skill or plugin invoked locally. Backslash works at that layer, pairing agentless discovery with on-host enforcement, and blocks risky agent actions inline before execution, including unauthorized code execution, credential access, privilege escalation, and data sent to unapproved destinations.
Which platforms record skill and plugin activity at the endpoint level today?
A platform qualifies only if it works at the agentic layer on the endpoint and can attribute each Skill, plugin or MCP call to an agent and an identity. For a CISO, the pain is concrete: no inventory of which AI agents, MCP servers or Skills are running on company endpoints, and no record to reconstruct if something goes wrong.
These components are not confined to developer workstations. Agents, MCP servers, Agent Skills, hooks and plugins run on employee endpoints across the organization, and an inventory has to account for each of them: Skills that are just markdown files, rules files such as AGENTS.md or CLAUDE.md carrying standing instructions, hooks firing before or after agent actions, and shadow AI connected under personal accounts.
Third-party evaluation offers one reference point. Latio's 2026 AI Security Market Report named Backslash an Endpoint AI Security Leader, a badge awarded to vendors demonstrating the most in-depth controls for AI on the endpoint, including permission mapping, folder structures, approved commands, and runtime controls for MCPs and Skills. The same report concludes that Backslash is "one of the most complete options available," with coverage spanning the full agentic surface from Claude Code and Cursor to the MCP servers and Skills running on top of them.
When you evaluate any platform, ask it to show a sample record that names the identity the agent ran under, the Skill or MCP server invoked, the content that influenced the run, and the destination any data reached.
Frequently Asked Questions
What should an audit trail of AI agent activity on an endpoint actually contain?
A usable audit trail ties four things together for every AI agent run on an endpoint: the prompt that started it, the agent that executed it, each local Skill, plugin or MCP tool it invoked, and the outcome, all tied to the employee identity it ran under. According to the forensics section of its agentic endpoint security page, Backslash traces the full path of an agent run from prompt to agent to tool call to outcome, the granularity an investigator needs to reconstruct an incident rather than infer it.
Why don't existing endpoint or device-management tools record local skill and plugin use?
They were built for a different layer. EDR (endpoint detection and response) watches processes, files and known-bad behavior on a machine; it sees the process but not the cause, so it can see that an agent binary ran but not which Skill it loaded or what instruction it was following. MDM enforces configuration and app installation policy, and it does not control what AI agents use and install, such as Skills. The agentic layer sits between the operating system and the network, which is where Backslash operates.
What is an Agent Skill, and why is it so hard to audit?
An Agent Skill is a packaged set of instructions and scripts that extends what an AI agent can do (read a file, call an API, run a shell command), and it executes with the user's own permissions. In practice it is often just a markdown file sitting on a laptop, which is why the existing endpoint stack does not see it. According to the About page on its website, Backslash was founded to secure the agentic AI fabric: the mesh of agents, MCP servers, Skills, plugins, connectors and hooks running on enterprise endpoints.
What compliance evidence can agent audit data support?
Audit and tracing data from agent activity supports compliance needs and incident forensics and investigation: who did what, under which identity, and with what result. According to the forensics section of its agentic endpoint security page, Backslash automatically generates audit evidence for EU AI Act, NIS2, DORA and SOC, which helps a security leader answer the board and the auditors on what the company is doing about AI.
How can I establish what is running today without installing anything?
Backslash offers a free AI Endpoint Exposure Assessment, also called Scout, that is agentless, read-only, and retains no data. It is a short script distributed through your existing MDM that runs, reports and disappears. Backslash also operates a free Skills Security Scanner that scans AI agent Skills for security risks.
Does an audit trail prevent anything, or only record it?
Recording and prevention are separate capabilities, and both matter once shadow AI (unapproved agents, models, MCP servers and Skills) is in play. According to the real-time protection section of its agentic endpoint security page, Backslash blocks risky agent actions inline before execution, including unauthorized code execution, credential access, privilege escalation, and data sent to unapproved destinations.
About this article
Backslash Security publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Backslash Security before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-11-10