Shadow AI is now hiding inside approved AI tools. Skills, plugins, hooks, and MCP servers can reshape what agents read, run, and expose. Security now includes the agent supply chain. #ClaudeCode #MCPoison #GitHubCopilot