Agent skills, plugins and MCP servers extend coding and productivity agents with instructions and scripts. Installing one gives its author influence over what your agent reads, writes and runs. The risks we found reviewing community skills, a review checklist, and the sandboxing and policy controls we use.
Connecting WhatsApp, Telegram or Slack to an LLM agent that can run tools on your server is a few hundred lines of glue and a large attack surface. This is the architecture we use: normalised channel adapters, sender pairing, a locked-down tool sandbox and hard budget caps.
In a red-team exercise our support agent read a customer-uploaded PDF with hidden instructions and drafted an email with another customer's order details. No data left the building, but the flaw was real. How we contained it with least privilege, confirmation and output checks.