Plugin Governance

Plugin governance encompasses the policies, controls, and oversight mechanisms organizations implement to manage third-party extensions and integrations within their AI systems and platforms. This matters for enterprise compliance because unvetted plugins can introduce security vulnerabilities, create data privacy risks, and undermine model behavior through uncontrolled modifications. Effective plugin governance ensures that all integrated tools meet organizational standards for performance, safety, and auditability while maintaining visibility into how external code affects AI system outputs and decision-making processes.

1 item

ResearchGlobal2026-08-07

1.7M Trojanized AI Skill Installs Expose Agent Marketplace as Active Attack Surface

Security firm Zenity disclosed a supply chain campaign in which malicious skills uploaded to the skills.sh agent marketplace accumulated over 1.7 million downloads between July 11 and August 2, 2026. The trojanized skills, which impersonated legitimate AI services Paperclip and Browser Use through typosquatting, instructed AI agents to install a credential stealer targeting SSH keys, cloud credentials, Kubernetes configurations, and CI runner secrets. The incident confirms that agent skill marketplaces are now an active attack surface and that conventional static analysis tools are poorly suited to detecting malicious natural-language skill instructions.

supply chain attack agentic AI risk credential theft agent marketplace AI agent security Zenity skills.sh plugin governance