A plugin is the box a workflow ships in. It can hold skills (how to do a job), apps (connections to tools like Slack, Google Drive, or a CRM), or both. You find them in the Plugin Directory in the sidebar.
ChatGPT uses a plugin automatically when it helps, or you call it with an @mention or the + menu. Some carry an OpenAI Verified badge, a quality check rather than a security approval. Plugins cannot bypass the permissions you or your admin set. Custom GPTs are being replaced by plugins.