Agent Skills vs MCP vs Plugins: What Each Is and When to Use It
An agent skill is a SKILL.md folder an agent loads on demand; MCP is a live protocol to tools and data; a plugin bundles both. What to use when.
#plugins
14 articles with this tag.
Arcade's $60M Round Makes Agent Permissions Infrastructure
Arcade.dev raised $60M in June 2026 for an agent authorization layer. What scoped permissions, MCP tool policy and audit trails mean for your agent stack.
Agentjacking Turns MCP Tool Output Into an Execution Path
Agentjacking hijacks AI coding agents with a fake Sentry error. Tenet found 2,388 exposed orgs, 100+ agents running attacker code, an 85% success rate.
IETF MCP Draft Turns Tool Safety Into a Standards Problem
An IETF Internet-Draft names 6 recurring MCP vulnerability classes and states that the MCP specification defines no normative security requirements.
Runaway Agent AWS Bill Shows Tool Budgets Are Permissions
An AI agent provisioned five AWS instances to port-scan DN42 and ran up $6,531.30 in about 24 hours. Cost, scope and rate are tool permissions, not prompt text.
Agent Phishing Shows Why Tool Permissions Need Identity Checks
Varonis and Imperva tested OpenClaw agents in June 2026: 2 of 4 phishing scenarios leaked live secrets. Identity-bound tool permissions are the fix.
OpenClaw Shows Why Agents Need a Bill of Materials
An Agent Bill of Materials lists every skill, plugin, MCP server, credential and paired device an agent can reach. OpenClaw's ClawJacked bug is why you need one.
Cisco Cloud Control Makes Agent Tool Governance Mainstream
Cisco Cloud Control puts AI agents, MCP connectors and a 50-partner tool marketplace inside infrastructure operations. What admission control that now requires.
Vercel's Skills API Turns Agent Skills Into Infrastructure
Vercel's skills.sh API exposes 600,000+ agent skills to any tool holding an OIDC token. Pin the content hash, not the name, before you let an agent install one.
VIPER-MCP Shows Agent Tools Need Taint Scanning
VIPER-MCP scanned 39,884 MCP server repos and confirmed 106 zero-days, 67 with CVE IDs. Agent tools need code-level taint analysis, not trust prompts.
Microsoft ACS: Agent Controls Move Into the Runtime
Microsoft's Agent Control Specification evaluates agent policy at 8 intervention points and returns 1 of 5 verdicts: allow, warn, deny, escalate, transform.
NSA MCP Guidance: Inventory Agent Tools Before They Drift
The NSA's May 2026 MCP guidance treats agent tooling as infrastructure: inventory every server, verify tool changes, and scan before trust drifts.
MCP RCE Debate: Treat Agent Plugins Like Executable Code
OX Security found a remote code execution design flaw in MCP's official SDKs: 10 CVEs, 30+ disclosures, 7,000+ exposed servers. Treat MCP servers as code.
Is It Safe to Install Claude Code Skills? How to Check One First
Claude Code skills run with your files, shell and credentials. ClawHavoc put 1,184 malicious skills in one registry. How to check one before you install.