What is the OWASP Agentic Skills Top 10?

The OWASP Agentic Skills Top 10 (AST10) catalogues the ten most critical risks in AI agent skills. A skill is a reusable bundle of instructions and resources that an AI agent can find, load, and run on its own. AST10 covers malicious skills, supply chain compromise, over-privileged skills, insecure metadata, untrusted external instructions, weak isolation, update drift, poor scanning, missing governance, and cross-platform reuse. It is an OWASP Incubator project: the v1 whitepaper went out for public review in August 2026 and v1.0 is targeted for Q4 2026.

How is AST10 different from the OWASP LLM Top 10?

The LLM Top 10 covers risks in applications built on large language models. AST10 covers a narrower and newer layer: the skills an agent installs and runs. The two overlap at excessive permissions, where LLM03 Excessive Agency describes what an agent may do and AST03 Over-Privileged Skills describes what each installed skill inside it may do.

Why can't normal code scanners catch malicious agent skills?

A skill's payload can be plain English instructing the agent to read a credentials file and send it somewhere. There is no suspicious function call, no obfuscated string, and nothing for a regex to match. This is AST08, Poor Scanning: against Snyk's toxicskills-goof test suite, SpecWeave's pattern-matching scanner caught three of four malicious samples and missed the one written purely as natural-language instructions.

OWASP Agentic Skills Top 10 (AST10)

By FixTheVuln Team Peer-reviewed security content Sources: CISA, NVD, OWASP

Test Your Knowledge

Security+ Practice Quiz CISSP Practice Quiz

← Back to Home

Key Takeaways

A skill is a reusable bundle of instructions an agent can find, load, and run on its own — and on most platforms it runs with the agent's own filesystem, shell, and credentials
AST10 is an OWASP Incubator project, not a finished standard: whitepaper v1 went out for public review in August 2026, with v1.0 targeted for Q4 2026
The malicious payload in a skill is often plain English, not code, which is why traditional scanners miss it (AST08)
Repository configuration files are execution paths now — cloning a repo can run code before any consent dialog (AST02)
Each risk maps to OWASP AISVS v1.0 and the CSA MAESTRO 7-layer threat model, with an indirect NIST AI RMF crosswalk

Securing the Skills Your Agent Installs

AI coding agents install skills the way browsers install extensions: from a registry, on a one-line command, often without review. The difference is what a skill gets when it loads. On most platforms today it inherits the agent's filesystem access, its shell, and its credentials, and it starts running before anyone has read what it says.

The OWASP Agentic Skills Top 10 (AST10) catalogues the ten risks in that layer. It exists because this stopped being hypothetical: the ClawHub registry became the first AI agent registry to be systematically poisoned at scale, and at peak infection five of the seven most-downloaded skills on it were confirmed malware.

Treat it as current best thinking rather than a settled standard. AST10 is an OWASP Incubator project in active development. Its v1 whitepaper was released for public review in August 2026 and v1.0 is targeted for Q4 2026, so risk titles and ratings can still move before release.

Each of the ten risks below has its own page with attack detail, the incident evidence the project cites, and a mitigation checklist.

AST01: Malicious Skills Critical AST02: Supply Chain Compromise Critical AST03: Over-Privileged Skills High AST04: Insecure Metadata High AST05: Untrusted External Instructions High AST06: Weak Isolation High AST07: Update Drift Medium AST08: Poor Scanning Medium AST09: No Governance Medium AST10: Cross-Platform Reuse Medium

How AST10 Relates to the LLM Top 10

These are different layers of the same stack. The AST10 project maps each risk to OWASP AISVS v1.0 and to the Cloud Security Alliance's MAESTRO 7-layer threat model for agentic systems, with an indirect NIST AI RMF crosswalk (NIST's first agent-specific deliverables are not expected until late 2026).

Question	Covered by
What can the model be tricked into saying or doing?	LLM01: Prompt Injection
What is the agent as a whole allowed to do?	LLM03: Excessive Agency
What is each installed skill allowed to do?	AST03: Over-Privileged Skills
Where did the skill come from, and is it what it claims?	AST01, AST04
Can what the skill points at change after review?	AST05: Untrusted External Instructions
What contains the damage when a skill turns hostile?	AST06: Weak Isolation

If you are securing an agent deployment, the LLM Top 10 and AST10 are both in scope. The OWASP LLM Top 10 (2026 edition) →

AST10 Summary

ID	Risk	Severity	Primary Defense
AST01	Malicious Skills	Critical	Signature verification, install-time behavioral scanning
AST02	Supply Chain Compromise	Critical	Hash pinning, provenance, treat repo config as code
AST03	Over-Privileged Skills	High	Permission manifests, per-skill scoped credentials
AST04	Insecure Metadata	High	Safe parsers, schema validation, publish-time analysis
AST05	Untrusted External Instructions	High	Hash-pin fetched docs, allowlist domains, audit chains
AST06	Weak Isolation	High	Container isolation by default, syscall confinement
AST07	Update Drift	Medium	Content-hash pinning, signature checks on update
AST08	Poor Scanning	Medium	Scan the prose layer, sandbox detonation
AST09	No Governance	Medium	Central inventory, approval workflow, audit logging
AST10	Cross-Platform Reuse	Medium	Re-validate on port, normalize security metadata

Severity ratings are the AST10 project's own, as published in its risk index.