⚡ Quick Summary
The OWASP Agentic Skills Top 10 establishes a comprehensive security baseline for the emerging layer of agentic AI skills—reusable bundles of markdown instructions, code helpers, metadata, and dependencies loaded into autonomous agent runtimes. Because skills execute with host agent permissions and blend natural-language prompts with executable scripts, they introduce novel threat vectors distinct from traditional application packages.
Targeting developers, security engineers, platform operators, and governance teams, this guide outlines ten primary risk categories across four key ecosystem segments: Skill Sourcing and Registry Trust, Execution Boundaries, Lifecycle Governance, and Cross-Platform Reuse. In addition to cataloging real-world vulnerabilities and campaign data, the document provides actionable technical mitigations, code samples, reference architecture proposals, and alignment across ISO/IEC 42001, CSA MAESTRO, and the EU AI Act.
🧩 What's Covered
The guide provides an exhaustive taxonomy of security risks specific to agentic skills:
- AST01 – Malicious Skills: Trojanized skills containing backdoors, credential stealers, persistent identity manipulation (via
SOUL.mdorMEMORY.md), cognitive degradation, and stealthy prompt injections. - AST02 – Supply Chain Compromise: Risks stemming from unvetted registries, registry flooding, dependency confusion, poisoned nested packages, and config-file hijacking (such as
.claude/settings.json). - AST03 – Over-Privileged Skills: Excessive permission grants enabling unintended blast radius, confused deputy scenarios, and Logic-layer Prompt Control Injection (LPCI).
- AST04 – Insecure Metadata: Brand impersonation, permission understating, risk tier spoofing, and unsafe deserialization across YAML frontmatter, JSON, or TOML configs.
- AST05 – Untrusted External Instructions: Mutable external documentation, documentation rug-pulls, reviewer bait-and-switch, and transitive prompt injection across chained multi-agent nodes.
- AST06 – Weak Isolation: Execution in unconfined host environments without containerization, leading to host escape, cross-agent workspace contamination, and exposed local WebSocket endpoints.
- AST07 – Update Drift: Uncontrolled hot-reloads, lack of immutable hash pinning, unverified upstream version updates, and rollback attacks.
- AST08 – Poor Scanning: Shortcomings of traditional regex and static scanners against semantic natural-language bypasses, Unicode/ASCII smuggling, bytecode poisoning, and adaptive prompt injection.
- AST09 – No Governance: Unmanaged shadow AI skills, absence of centralized skill inventories, and missing compliance audit trails. The guide specifies a Bilateral Receipt Pattern generating signed admission and outcome receipts to support EU AI Act Article 12 compliance.
- AST10 – Cross-Platform Reuse: Security property degradation and manifest stripping when porting skills across diverse environments (e.g., OpenClaw, Claude Code, Cursor, VS Code). The document puts forward an open Universal Agentic Skill Format.
💡 Why it matters?
As agentic AI shifts from conversational interfaces to autonomous execution units, skills act as dynamic plugins with broad operational capabilities. Attackers increasingly bypass conventional perimeter tools by exploiting natural-language ambiguity, configuration hooks, and cross-platform translation gaps. Understanding the unique attack surfaces detailed in this taxonomy—such as logic-layer injection, memory poisoning, and metadata tampering—is critical for securing agentic workflows, protecting organizational data, and implementing defensible, compliance-ready AI governance frameworks.
❓ What's Missing
The publication intentionally defers assigning standardized risk severity scores, noting that AI Vulnerability Scoring System (AIVSS) v1.0 scoring will not be integrated until late 2026. Additionally, while the guide introduces architectural proposals such as the Universal Agentic Skill Format and bilateral execution receipts, several complex features—such as multi-skill fan-in causal reconstruction—remain tracked as open community issues rather than finalized industry standards.
👥 Best For
This guide is essential for AI security architects, DevSecOps engineers, platform developers building agent marketplaces, enterprise risk and compliance officers implementing ISO/IEC 42001 or EU AI Act controls, and security researchers auditing autonomous agent ecosystems.
📄 Source Details
- Document: OWASP Agentic Skills Top 10 (August 2026 Publication)
- Publisher: OWASP Foundation Community Project
- Project Lead: Ken Huang (DistributedApps.ai)
- Format: Community Security Standard & Technical Guide (66 pages)
- Official Repository: OWASP Agentic Skills Top 10 GitHub
📝 Thanks to
Special recognition is given to Project Leader Ken Huang and Co-Leads Akram Sheriff, Aonan Guan, Bhavya Gupta, Fabio Cerullo, Hammad Atta, Iftach Orr, and Niv Hoffman, alongside Starr Brown of OWASP and the OWASP AIVSS community for foundational contributions to agentic AI security.
