OWASP Agentic Skills Top 10

Security Risks and Mitigations for AI Agent Skills

Covering OpenClaw (SKILL.md YAML), Claude Code (skill.json), Cursor/Codex (manifest.json), and VS Code (package.json) ecosystems.

---

Table of Contents

• Overview
• The Problem: A Crisis Already in Progress
• What Are Agentic Skills?
• Incident Timeline (2026)
• The 10 Risks — Summary Table
• Detailed Risk Descriptions
  • AST01 — Malicious Skills
  • AST02 — Supply Chain Compromise
  • AST03 — Over-Privileged Skills
  • AST04 — Insecure Metadata
  • AST05 — Unsafe Deserialization
  • AST06 — Weak Isolation
  • AST07 — Update Drift
  • AST08 — Poor Scanning
  • AST09 — No Governance
  • AST10 — Cross-Platform Reuse
• Universal Skill Format Proposal
• Relationship to Existing OWASP Projects
• Getting Started
• Target Audience
• Project Status and Timeline
• Key Deliverables
• Scope
• Leadership and Governance
• Key Research and References
• License

---

Overview

The OWASP Agentic Skills Top 10 (AST10) documents the 10 most critical security risks in agentic AI skills across all major AI agent platforms. Skills represent the execution layer that gives agents real-world impact: they define not just what resources agents can access, but how they orchestrate multi-step workflows autonomously.

While significant attention has been devoted to securing large language models (LLMs) and the Model Context Protocol (MCP) tool layer, the intermediate behavior layer—embodied in agentic skills—has emerged as a particularly vulnerable and under-protected component of the AI agent ecosystem. This project exists to close that gap.

Mental Model: MCP = how the model talks to tools; AST10 = what those tools actually do.

---

The Problem: A Crisis Already in Progress