TL;DR: Shadow AI is increasingly hiding in plain markdown files and installable plugins rather than obvious chatbots, with skills and plugins spreading outside central approval while exposing secrets, code execution, and audit gaps, according to Willow. The governance problem is not discovery alone but the collapse of review, ownership, and least-privilege assumptions at the point where agents inherit capability.
At a glance
What this is: This is an analysis of how unapproved AI skills and plugins create a shadow AI risk surface that traditional governance tools miss.
Why it matters: It matters because identity and security teams need visibility into locally installed AI capability, not just sanctioned chatbots or MCP servers, if they want to control access, secrets, and auditability.
Context
Shadow AI becomes materially harder to govern when capability is distributed as a file or plugin rather than a centrally managed application. In practice, the security gap is not just unapproved access, but unapproved execution paths that can read data, call APIs, and change systems without passing through normal review.
The core governance failure is that organisations often look for shadow AI in visible places such as chat interfaces and central gateways. Skills and plugins shift the control point to the endpoint and the agent runtime, where ownership, approval, and inventory are often missing.
Key questions
Q: What breaks when AI skills and plugins are added outside central approval?
A: Governance breaks at the point of capability inheritance. The organisation loses track of what the agent can do, who approved it, and which systems it can reach, so review, accountability, and least privilege all become unreliable. That is why unapproved skills and plugins should be treated as controlled execution paths, not convenience features.
Q: Why do unapproved AI skills and plugins create more risk than a visible chatbot?
A: A chatbot is usually the visible interface, but a skill or plugin changes what the agent can actually do. It can expose secrets, run code, and reach internal systems, often without passing through the same approval checkpoints that would govern a normal application. The risk is broader because the capability is attached where the work happens.
Q: How can security teams detect shadow AI without relying on gateway logs alone?
A: They need inventory, local telemetry and policy coverage across all the places agents run, including IDEs, terminals and browser-based assistants. Gateway logs only show traffic that passes through the gateway. Off-gateway hooks, SIEM export and identity-aware monitoring help reveal activity that would otherwise remain outside governed paths.
Q: When should organisations block a skill or plugin instead of allowing it through governance?
A: Block it when it cannot be tied to an owner, cannot be scoped to a specific action, or introduces code execution and secret exposure without a reviewable control. The decision should be based on the capability's blast radius, not on whether it is popular or convenient for users.
Technical breakdown
Why markdown-based skills create an unreviewed control plane
A skill is effectively executable guidance packaged as plain text, which makes it easy to distribute and difficult to govern. Because the agent follows instructions from the file at runtime, the real control plane becomes the content of the skill, not the system that delivered it. That breaks conventional assumptions about software approval, because there is no install event, no package signature requirement in the article's model, and no central registry by default. The risk is not only what the skill says, but that it can shape agent behaviour without a formal governance workflow. See the Shadow AI and AI Agent Discovery Guide.
Practical implication: Treat skill files as governed execution artefacts, not harmless documentation.
How plugins expand shadow AI from instruction to execution
Plugins are more dangerous than skills because they can run code and reach APIs, repositories, and internal services. That means a plugin can turn agent intent into direct system action, often with whatever permissions the agent already has. In governance terms, the issue is delegated execution without delegated accountability: the tool chain expands faster than policy can follow. Once a plugin is locally installed, the organisation may have capability exposure without having a corresponding identity record, approval trail, or inventory entry.
Practical implication: Inventory every plugin that can execute code or touch internal systems and treat it as privileged software.
Why discovery tools miss shadow AI at the point of use
Traditional DLP, IAM, CASB, and network controls were built around centrally routed traffic and known application boundaries. Skills and plugins bypass that model because they are often installed locally and act at the prompt and tool layer, where legacy tools have little visibility. The result is a blind spot: the action happens inside the agent workflow, not at a gateway. The article's key point is that the hidden surface is not the model itself, but the capability attached to it after deployment.
Practical implication: Shift discovery to endpoints and browser-level signals where unapproved capability actually appears.
Threat narrative
Attacker objective: The objective is to gain ungoverned execution through AI capability that can reach data, tools, and systems without normal security oversight.
- Entry occurs when a user adds an unapproved skill or plugin through a plain markdown file or a quick install path, outside central review.
- Credential and capability exposure follows when the skill file contains secrets or the plugin inherits broad API and system access from the agent.
- Escalation happens when the agent executes code, queries data, or acts on internal systems using capabilities no security team approved.
- Impact is unauthorised data access, code execution, or data movement with no reliable audit trail tying the action back to an approved governance decision.
Breaches seen in the wild
- Samsung ChatGPT leak 2023: Samsung staff pasted chip source code and meeting notes into ChatGPT weeks after it was allowed, leading Samsung to restrict generative AI tools.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Shadow AI governance fails when the control surface moves from application approval to capability attachment. Skills and plugins are not just another software category. They create a secondary layer of authority over the agent, which means the organisation is no longer governing only who can use AI, but what instructions and code the AI can inherit at runtime. The practitioner implication is that approval models built for apps do not automatically govern capability packages.
Unapproved capability is an identity problem before it is an AI problem. The article shows that skills and plugins are connected by hand, often without a durable link to the person who added them or the policy that allowed them. That creates a governance gap in attribution, ownership, and review. Security teams should treat this as a lifecycle issue for shadow AI discovery, not as an isolated tooling problem.
Least privilege collapses when agents inherit broad reach from a small piece of unreviewed content. A skill built for one task can still influence a workflow with far more access than the task requires, and a plugin can execute with whatever the agent already has. That is a classic privilege expansion pattern, but the trigger is not a role assignment. The implication is that privilege must be scoped around the action and the capability, not just the agent account.
Auditability disappears when capability is added outside a governed control plane. The article's strongest warning is not only that organisations do not know how many skills and plugins are active, but that they cannot reconstruct who approved them, who used them, and which data they touched. That is a material governance failure, because incident response and accountability both depend on reconstructable provenance. Practitioners should assume the record is incomplete until discovery proves otherwise.
From our research library:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- One in five organisations reported a breach due to shadow AI, and 97% of those breached through an AI model or application lacked proper AI access controls, according to IBM's 2025 Cost of a Data Breach Report.
- Read next: Shadow AI and AI Agent Discovery Guide
What this signals
Capability sprawl, not chatbot sprawl, is the operational problem now. Security programmes that only inventory sanctioned AI interfaces will miss the more durable threat: skills and plugins that expand agent behaviour outside governance. The practical shift is from model-centric oversight to capability-centric control, with discovery at the endpoint and policy at the action boundary.
Shadow AI governance will increasingly resemble lifecycle management for machine capability. When instructions and plugins can be added by anyone, the control question becomes who can introduce, inherit, and remove capability over time. That makes offboarding, review, and exception handling as important for AI surfaces as they already are for other non-human identities.
24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026. That figure shows how quickly adjacent AI tooling can accumulate credential risk once capability management is informal. The lesson for practitioners is to govern where secrets can appear, not only where users can see them.
For practitioners
- Build a complete capability inventory Discover every skill, plugin, and connected MCP surface across endpoints and browsers, then record who added it, what it can touch, and where it runs.
- Classify capability by action scope Set approval rules around the data, tools, and operations each skill or plugin can reach, not just whether the underlying agent is allowed.
- Remove secrets from local skill files Scan markdown-based skills and adjacent config for API keys, tokens, and other secrets, then revoke anything exposed outside a secrets manager.
- Treat plugins as privileged software Require review before any plugin that can execute code or access internal services is installed on an endpoint or linked to an agent.
- Create a governed self-service path Give users approved skills and plugins through a controlled catalogue so teams can move fast without resorting to informal installs.
Key takeaways
- Unapproved AI skills and plugins create a shadow AI surface that bypasses the approval models most organisations still use for apps and chatbots.
- The main risk is not only discovery failure but unreviewed execution, secret exposure, and privilege inheritance at the agent layer.
- Security teams need endpoint-level visibility, action-scoped policy, and a governed self-service path if they want AI capability to stay inside guardrails.
Related NHI Mgmt Group resources: Shadow AI and AI Agent Discovery Guide · MCP Security Guide · NHI Authentication Guide · Agentic AI Identity Risk Board Briefing
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Skills can contain API keys and tokens in plaintext files, creating direct secret exposure risk. |
| NHI-05 — Overprivileged NHI | The article highlights agents getting more reach than the task requires through attached skills and plugins. | |
| NHI-10 — Human Use of NHI | Users are adding capability by hand without central approval, which is an uncontrolled human-to-NHI delegation pattern. | |
| Recommendation — Scan skill files for embedded secrets and revoke any credentials found outside managed storage. Scope each skill and plugin to the minimum tools and data needed for the action. Require approval and traceability for any human-initiated attachment of capability to an agent. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about ungoverned permissions and entitlements attached to AI capability. |
| Recommendation — Review AI-related entitlements so only approved capabilities can reach sensitive systems. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article describes secret exposure and downstream movement through internal tools and data. |
| Recommendation — Map exposed skills and plugins to credential access and lateral movement detection coverage. | ||
Key terms
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
- Skill: A skill is a modular instruction package that teaches an agent how to perform a task at runtime. It can include a markdown instruction file, metadata, scripts, and supporting documents. In agentic environments, a skill is not passive documentation. It is an active control input that can shape behaviour, tool use, and execution.
- Plugin: A Plugin is a modular policy component that extends gateway behaviour without changing the service itself. Common uses include authentication, rate limiting, logging, and caching, which lets teams enforce security and traffic controls at the gateway boundary.
- Scope Sprawl: Scope sprawl is the accumulation of excessive, duplicated, or stale OAuth permissions across many applications and users. It usually grows when teams approve broad access for convenience and never remove it, leaving a large and poorly understood delegated-access surface.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org