Published
- 5 min read
By Allan D - Editor, AI Security Wire
OWASP Publishes Agentic Skills Top 10 to Secure AI Agent Add-Ons
OWASP has a new top ten list, and this one is aimed squarely at a part of the AI agent stack that has mostly flown under the radar: skills. On August 17, the OWASP Agentic Skills Top 10 project shipped version 1.0, giving security teams the first dedicated framework for the reusable instruction bundles that agents like Claude Code, OpenClaw, and Cursor pull in and execute on their own.
If that sounds like a niche corner of the AI security world, the numbers say otherwise.
Why skills got their own top ten
Most of the security conversation around AI agents so far has centered on two layers: the model itself, and the Model Context Protocol servers that connect it to tools. AST10 argues there’s a third layer sitting in between that nobody’s been watching closely enough. Project lead Ken Huang, CEO of DistributedApps.ai, put it bluntly in the project’s launch materials: “Skills moved faster than anyone’s threat model. We had a distribution channel with npm’s reach and none of npm’s decade of hard-won security infrastructure, no signing, no provenance, no shared vetting between registries.”
That’s the core problem. A skill is plain-language instructions plus supporting files that an agent loads and follows, often from a public registry, often without much scrutiny. Rob Joyce, the former NSA Cybersecurity Director now running Joyce Cyber LLC, framed it as a trust exploit: skills run “with the agent’s permissions, invisible to every tool built to read code.” His take is that AST10 is the first framework to treat that behavior layer as an actual attack surface rather than a configuration footnote.
The ten risks, and the data behind them
AST10 lists ten categories, ranked by severity: malicious skills and supply chain compromise sit at critical; over-privileged skills, insecure metadata, untrusted external instructions, and weak isolation are high; update drift, poor scanning, missing governance, and cross-platform reuse round out the medium tier.
The project backs this up with figures pulled from existing research rather than fresh claims of its own. A Snyk ToxicSkills audit scanned 3,984 skills across registries and found 36.82 percent, or 1,467, carried some kind of security flaw, with 534 rated critical and more than 76 confirmed as outright malicious payloads. Separately, Antiy CERT documented a campaign researchers named ClawHavoc that involved 1,184 malicious skills. The write-up also points back to the ClawHub registry poisoning uncovered earlier this month, where five of the seven most-downloaded skills at peak infection turned out to be malware, plus two Claude Code vulnerabilities Check Point Research disclosed (CVE-2025-59536 and CVE-2026-21852) that let a cloned repository trigger code execution before a user ever sees a consent prompt.
None of that is new information exactly, it’s the kind of fragmented, single-vendor research this site has already covered piecemeal. What AST10 does is stitch it into one framework with a common vocabulary, which is arguably overdue given how scattered the prior reporting has been.
A format built to travel
The other half of the release is the Universal Skill Format, a proposed YAML manifest meant to let a skill move between OpenClaw, Claude Code, Cursor, and VS Code without shedding its security metadata along the way. The spec calls for ed25519 signatures tied to a publisher identity, explicit deny lists that protect sensitive files like SOUL.md and memory stores, domain allowlists in place of simple on/off network toggles, and a four-tier risk classification (L0 through L3) meant to feed automated governance tooling.
Omar A. Turner, Microsoft’s General Manager of Security, framed the stakes in industry terms: “The AST10 gives defenders what was missing: a common language for the behavior layer, grounded in confirmed incidents, with mitigations designed to fail closed instead of failing quietly.” Jason Clinton, the former Chrome Infrastructure Security Lead and former Anthropic CISO, called it “a much-needed security baseline for the emerging agentic ecosystem.”
What this means for teams running agents
AST10 is still an OWASP incubator project, not a certification or a mandate, and adoption of the Universal Skill Format depends entirely on whether registry operators and agent vendors actually implement it. But it gives security teams something concrete to hand to procurement and engineering: a checklist for evaluating third-party skills before they land in a production agent, and a shared risk taxonomy for talking about the problem across vendors.
Given how fast skill marketplaces have grown this year and how little vetting most of them do, having a reference framework, even an early one, beats the current default of trusting whatever a registry happens to list. If your organization has agents pulling skills from public sources, this is worth reading before the next one turns out to be a supply chain problem you inherited unknowingly.
References
Frequently Asked Questions
- What is the OWASP Agentic Skills Top 10 (AST10)?
- AST10 is a new OWASP framework, version 1.0 published August 17 2026, that documents the ten most critical security risks in AI agent skills, the packaged instruction bundles that agents like Claude Code, OpenClaw, and Cursor load and run. It covers risks from malicious skills and supply chain compromise to weak isolation and missing governance.
- What is the Universal Skill Format OWASP is proposing?
- It's a proposed cross-platform YAML manifest that lets a skill move between agent ecosystems without losing its provenance. It calls for ed25519 cryptographic signing, explicit deny lists protecting sensitive files, domain allowlists instead of blanket network access, and L0-L3 risk tiers for automated governance.
- How big is the malicious skill problem right now?
- A Snyk audit cited in the AST10 project found 36.82 percent of 3,984 scanned skills contained security flaws, with 13.4 percent rated critical and more than 76 confirmed malicious payloads. Separately, Antiy CERT tracked 1,184 malicious skills in a campaign researchers dubbed ClawHavoc.
- Is this the same as OWASP's LLM Top 10 or Agentic AI Top 10?
- No. Those frameworks address the model layer and general agentic application risks. AST10 is scoped specifically to the 'skills' layer, the instruction bundles agents load at runtime, which OWASP argues has been left largely unprotected while attention went to LLMs and MCP tool servers.