OWASP Agentic Skills Top 10 | OWASP Foundation

For full functionality of this site it is necessary to enable JavaScript. Here are the instructions how to enable JavaScript in your web browser.

This website uses cookies to analyze our traffic and only share that information with our analytics partners.<br>Accept

Store

Donate

Join

OWASP Agentic Skills Top 10

Security Risks and Mitigations for AI Agent Skills

Covering OpenClaw (SKILL.md YAML), Claude Code (skill.json), Cursor/Codex (manifest.json), and VS Code (package.json) ecosystems.

Breadcrumb: OWASP > Projects > Agentic Skills Top 10

Public review (v1): Please review and comment on the merged v1 draft in the Google Doc. Previous GitHub issues and pull requests remain available for historical reference, but v1 publication comments should be submitted in the Google Doc.

Tutorial videos: Use the AST10 tutorial video library to play each risk video from selectable cards or share direct links with ?video=ast01 through ?video=ast10.

Table of Contents

Overview

📊 Visual Top 10 Overview

Tutorial Videos

The Problem: A Crisis Already in Progress

What Are Agentic Skills?

Incident Timeline (2026)

Summary Table

Universal Skill Format Proposal

Case Studies

Threat Intelligence

Interactive Risk Assessment Tool

Skill Scanner Integration

API Documentation

Skill Development Guide

Platform Comparison

Community & Contribution

Incident Response Playbook

Security Metrics & Monitoring

Getting Started

Target Audience

Project Status and Timeline

Leadership and Governance

Key Research and References

License

Overview

The OWASP Agentic Skills Top 10 (AST10) documents the 10 most critical security risks in agentic AI skills across all major AI agent platforms. Skills represent the execution layer that gives agents real-world impact: they define not just what resources agents can access, but how they orchestrate multi-step workflows autonomously.

While significant attention has been devoted to securing large language models (LLMs) and the Model Context Protocol (MCP) tool layer, the intermediate behavior layer —embodied in agentic skills—has emerged as a particularly vulnerable and under-protected component of the AI agent ecosystem. This project exists to close that gap.

Mental Model : MCP = how the model talks to tools; AST10 = what those tools actually do.

Quick Security Checklist

Use this checklist to assess your agent skill security posture:

Registry & Installation

Only install skills from verified publishers with code signing

Enable automated scanning for all skill installations

Review skill permissions before installation

Pin skill versions to prevent automatic malicious updates

Runtime Security

Run agents in isolated environments (containers/sandbox)

Implement network restrictions for agent processes

Monitor agent file system and network activity

Regularly audit installed skills and their dependencies

Governance & Monitoring

Maintain inventory of all deployed agent skills

Implement approval workflows for skill installations

Enable comprehensive audit logging for agent actions

Establish incident response procedures for skill compromises

Development Practices

Sign all published skills with cryptographic keys

Include comprehensive permission manifests

Test skills in isolated environments before publishing

Document security considerations in skill metadata

See the complete Security Assessment Checklist for detailed guidance.

The Problem: A Crisis Already in Progress

This is not a theoretical future risk. The AI agent skill ecosystem is under active attack as of Q1 2026.

By the numbers:

Metric<br>Figure<br>Source

Skills scanned<br>3,984<br>Snyk ToxicSkills (Feb 2026)

Skills with security flaws<br>1,467 (36.82%)<br>Snyk ToxicSkills (Feb 2026)

Skills with critical issues<br>534 (13.4%)<br>Snyk ToxicSkills (Feb 2026)

Confirmed malicious payloads<br>76+<br>Snyk ToxicSkills (Feb 2026)

ClawHavoc campaign: malicious skills<br>1,184<br>Antiy CERT (Feb 2026)

OpenClaw instances internet-exposed<br>135,000+<br>SecurityScorecard (Feb 2026)

CVEs disclosed (OpenClaw alone)<br>9 (3 with public exploits)<br>Endor Labs (Feb 2026)

Skills analyzed across all registries<br>30,000+<br>National CIO Review / Cisco (2026)

Skills containing at least one vulnerability<br>>25%<br>National CIO Review (2026)

The ClawHub registry—the primary marketplace for OpenClaw skills—became the first AI agent registry to be systematically poisoned at scale . Five of the top seven most-downloaded skills at peak infection were confirmed malware. The registry has since implemented automated scanning and partnered with VirusTotal, but the broader ecosystem remains largely unprotected.

Check Point Research disclosed two critical vulnerabilities in Claude Code (CVE-2025-59536, CVSS 8.7; CVE-2026-21852, CVSS 5.3) demonstrating that repository-level configuration files now function as part of the execution layer —simply cloning and opening an untrusted project can trigger remote code execution and API key...