Topic starter
25/10/2026 11:02 am
TL;DR: Unapproved AI skills and plugins are spreading outside central approval, exposing secrets, code execution and audit gaps, according to Willow. Agent oversight has to cover local execution and inherited capability, or review and least privilege will fail at the point of use.
Editorial analysis by NHI Mgmt Group, based on content published by Willow: “Shadow AI: The Skills and Plugins Nobody Approved”.
Key questions
Q: Why do unapproved AI skills and plugins create more risk than a visible chatbot?
A: A chatbot is usually the visible interface, but a skill or plugin changes what the agent can actually do.
Q: How can security teams detect shadow AI without relying on gateway logs alone?
A: They need inventory, local telemetry and policy coverage across all the places agents run, including IDEs, terminals and browser-based assistants.
Q: What breaks when AI skills and plugins are added outside central approval?
A: Governance breaks at the point of capability inheritance.
Practitioner guidance
- Build a complete capability inventory Discover every skill, plugin, and connected MCP surface across endpoints and browsers, then record who added it, what it can touch, and where it runs.
- Classify capability by action scope Set approval rules around the data, tools, and operations each skill or plugin can reach, not just whether the underlying agent is allowed.
- Remove secrets from local skill files Scan markdown-based skills and adjacent config for API keys, tokens, and other secrets, then revoke anything exposed outside a secrets manager.
Bottom line: Unapproved AI skills and plugins create a shadow AI surface that bypasses the approval models most organisations still use for apps and chatbots.
Glossary terms: Shadow AI, Skill, Plugin, Scope Sprawl
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:18 pm
Shadow AI governance fails when the control surface moves from application approval to capability attachment. Skills and plugins are not just another software category. They create a secondary layer of authority over the agent, which means the organisation is no longer governing only who can use AI, but what instructions and code the AI can inherit at runtime. The practitioner implication is that approval models built for apps do not automatically govern capability packages.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- One in five organisations reported a breach due to shadow AI, and 97% of those breached through an AI model or application lacked proper AI access controls, according to IBM's 2025 Cost of a Data Breach Report.
A question worth separating out:
Q: When should organisations block a skill or plugin instead of allowing it through governance?
A: Block it when it cannot be tied to an owner, cannot be scoped to a specific action, or introduces code execution and secret exposure without a reviewable control. The decision should be based on the capability's blast radius, not on whether it is popular or convenient for users.
👉 Read our full editorial: Shadow AI skills and plugins create the fastest-growing blind spot
This post was modified 7 days ago by NHI Mgmt Group