Checked August 2026
Agent plugin laboratory
How AI plugins extend a host runtime—and its attack surface
Plugin is a host-specific packaging term. A plugin may register tools, hooks, model providers, channels, skills, commands, or configuration—and may execute code with the host's authority.
Review the signed manifest and each permission before installation. Then observe surface registration, atomic rollback, runtime enablement, and a kill switch that unregisters tools and channels, revokes grants, and invalidates the stored credential.
- Inspect
- Manifest · publisher · permissions · runtime hooks
- Changes
- Executable packages and registered surfaces
- Security rule
- Install and update are trust decisions
Plugin trust and runtime consoleactive
- 01manifestcompleted
The host parsed the package identity, compatibility range, requested permissions, and runtime surfaces.
- 02permission-reviewcompleted
The operator granted exactly the reviewed permission set.
- 03installcompleted
The package is installed but remains disabled until all declared surfaces register.
- 04register-surfacescompleted
The host registered each declared channel, command, and tool entrypoint.
- 05activecompleted
The extension is enabled and only its registered surfaces are callable.
- 06kill-switchnot-reached
Not reached in this run.
{
"id": "com.example.slack-channel",
"name": "Slack channel adapter",
"version": "1.3.0",
"hostApi": "^2.0.0",
"permissions": [
"network:slack.com",
"secrets:slack-token",
"messages:read",
"messages:write"
],
"surfaces": [
{
"type": "channel",
"id": "slack",
"entrypoint": "dist/channel.mjs"
},
{
"type": "command",
"id": "slack:disconnect",
"entrypoint": "dist/commands.mjs"
},
{
"type": "tool",
"id": "slack_send_message",
"entrypoint": "dist/tools.mjs"
}
]
}dist/channel.mjsdist/commands.mjsdist/tools.mjsLifecycle ledger
01manifest-validated{"event":"manifest-validated","pluginId":"com.example.slack-channel","version":"1.3.0"}
02permissions-granted{"event":"permissions-granted","permissions":["network:slack.com","secrets:slack-token","messages:read","messages:write"]}
03package-installed{"event":"package-installed","pluginId":"com.example.slack-channel"}
04surfaces-registered{"event":"surfaces-registered","surfaceIds":["slack","slack:disconnect","slack_send_message"]}
05plugin-enabled{"event":"plugin-enabled","pluginId":"com.example.slack-channel"}
Primary research
Inspect the mechanism at its source.
Project architecture and terminology were checked against official documentation on August 10, 2026. Research papers are linked to their original publication records.