Strangers With Capabilities
“It was in the marketplace” is a distribution story. The access review is still waiting.
What it is
Strangers With Capabilities is adding an agent extension without establishing who supplies it, what it executes or sends elsewhere, and which authority it can use. Skills, plugins, and Model Context Protocol (MCP) servers can introduce different kinds of trust. Treating them all as harmless menu items skips the integration decision.
First, find out what you installed
A skill may consist of instructions and optional scripts. Its text can influence the agent; it does not itself receive an operating-system permission just because the agent reads it. A local server runs a process with the permissions its runtime grants. A remote integration receives the inputs sent to it and may use separately authorized access to another service. A plugin may bundle several of these pieces.
There are two boundaries to inspect: what the extension can execute directly, and what it can persuade the agent to do through other tools. Restricting one does not necessarily restrict the other. A local process may read files without asking the model; instructions containing no code may still induce a file upload through a tool the agent already has.
A capability mismatch
In an illustrative workflow, a team installs a local document converter for an agent that also handles customer support. The converter needs an input directory and an output directory, but its launch configuration exposes the user’s home directory and inherited credentials, with unrestricted outbound network access. A malicious or compromised version could read and transmit unrelated files without using the agent’s send-email tool at all.
The missing control is at the process boundary. Asking the model to approve each conversion does not inspect everything the converter does while it runs. MCP’s security guidance on local servers addresses startup-command consent and restricting filesystem, network, and other system access.
An instruction-only variant needs no converter process: an illustrative summarization skill tells the agent to upload the whole customer folder to an external “diagnostic” service. The upload may be within the agent’s technical permissions but outside the user’s task. Tool descriptions and returned text can also carry instructions; MCP’s tool specification tells clients to treat tool annotations from untrusted servers as untrusted. Installation does not make every later instruction an authorized request.
Why it’s dangerous
An extension can remain available across many tasks, and an update can change what it does. A one-time review of the first version leaves a gap if later code, instructions, or permissions change silently. Remote services can also change behind a stable tool name.
Marketplace review and sandboxing vary. Check the particular distributor’s controls rather than assuming either universal vetting or none at all. Popularity helps explain why a package was noticed; it does not explain why a document converter needs credentials for customer accounts.
The serious team fix
- Inspect the thing that will run. Review instruction files, startup commands, bundled scripts, dependencies, and destinations. Identify the publisher and how updates reach the installation. AI can help trace access and flag mismatches, but a summary of the advertised purpose is not an inspection of the implementation. For a closed remote service, assess its documented controls and data handling, and record the visibility you do not have.
- Grant access at an enforceable boundary. Give the converter only its task directories and required network destinations, with no unrelated credentials. Use narrower service identities and scopes for remote integrations. Executable extensions need a constrained runtime; if the host cannot provide one, run them in a separate environment that can. For a skill consisting only of instructions, an agent with fewer tools and narrower credentials limits the actions those instructions can induce. Enforce approval of consequential transfers or writes outside the authorized task at the tool boundary, including the destination and actual data involved. Check both boundaries with harmless probes: a process attempting a forbidden file read, and instructions attempting an unapproved upload.
- Own updates and removal. Record installed versions, approved access, an owner, and how to disable the extension and revoke its grants. Pin local releases where supported, then review and apply updates deliberately; an indefinitely frozen dependency also accumulates risk. Reassess remote integrations when permissions or service behavior change. Test removal before an incident makes the inventory urgent.