It's every external component an agent pulls in to do its job: Skills, MCP servers, plugins, connectors, hooks, rules files and the models themselves. Each one is third-party code or third-party instructions running with your agent's privileges on an employee endpoint. The agent is yours; most of what gives it power is not.
Traditional dependencies pass through a gate. A package enters through a build, gets scanned, and lands in a lockfile someone can review. An agent can be told mid-conversation to install a Skill, connect to a new MCP server, or fetch a script - and it will often comply, especially when the instruction looks like it came from the user or from trusted content it just read. There is no CI, no pull request, and no review step.
Treat each one as a new member of your software supply chain, not as a browser extension. An MCP server is a running program with its own code and permissions, connecting your agent to files, databases, APIs and SaaS applications. Before installing one you need to know who publishes it, how it updates, whether it carries known vulnerabilities, and what it can reach. Backslash has assessed more than 81,000 public MCP servers, and the risk distribution is not reassuring.
Some are not. In a study of roughly 98,000 publicly available Skills, researchers confirmed 157 as malicious - carrying hidden instructions meant to steer the agent, or executable code doing more than the Skill advertised. The problem is that a malicious Skill does not look like an attack. It looks like a convenience, and it does its advertised job while doing something else as well.
Answer four questions: who publishes it, how it gets updated, whether it has known vulnerabilities or malicious behavior, and what it can actually reach. If you can't answer all four, treat it as untrusted. Backslash runs free scanners for both - the MCP Server Security Hub and the Skills Security Scanner - and assesses internally developed components using the same analysis.
A rug pull is when a component you already trust turns hostile in an update. You installed it legitimately from a real project, so the update arrives without a second look. This is the hardest supply chain path to catch, because nothing unusual happens - no intrusion, no alert, just a normal update to something already approved.
No, and this is where the Shai-Hulud campaign caught people out. By abusing npm's Trusted Publishing through OIDC, malicious packages shipped with valid provenance. Provenance proves a trusted workflow built the package. It says nothing about whether the source entering that workflow was authorized.
No. SCA reads manifests and lockfiles for application dependencies. It does not parse Skill files, assess MCP servers and their exposed tools, or inspect agent configuration and rules files - and those are executable artifacts that run before any application code exists. This is a coverage gap rather than a tuning problem.
Yes, using entirely legitimate mechanisms. A component running with the agent's privileges can read credential files, environment variables and configuration, then move data out through a sanctioned tool call. The Shai-Hulud campaign's collector specifically enumerated agent configuration directories including ~/.claude/, ~/.codex/ and ~/.cursor/ - AI tooling is now both the execution platform and the target.
Continuous assessment rather than a one-time check, because the component that passed review last month may have updated since. Backslash continuously evaluates every Skill, MCP server, plugin and hook for hidden instructions, malicious behavior, excessive permissions and untrusted dependencies - and assesses combinations, because a credential-reading Skill plus an internet-reaching connector is an exfiltration path that neither component creates alone.
Privacy is important to us, so you have the option of disabling certain types of storage that may not be necessary for the basic functioning of the website. Blocking categories may impact your experience on the website. More information
