{"slug": "owasp-agentic-skills-top-ten", "title": "OWASP Agentic Skills Top Ten", "summary": "The OWASP Foundation released the Agentic Skills Top 10 (AST10), a list of the 10 most critical security risks in agentic AI skills across major AI agent platforms, including OpenClaw, Claude Code, Cursor/Codex, and VS Code. The project, currently in public review for v1, aims to address vulnerabilities in the behavior layer of AI agents, which orchestrates multi-step workflows autonomously, and includes a quick security checklist covering registry, runtime, and governance measures.", "body_md": "# OWASP Agentic Skills Top 10\n\nSecurity Risks and Mitigations for AI Agent SkillsCovering OpenClaw (SKILL.md YAML), Claude Code (skill.json), Cursor/Codex (manifest.json), and VS Code (package.json) ecosystems.\n\n**Breadcrumb:** [OWASP](https://owasp.org/) > [Projects](https://owasp.org/projects/) > Agentic Skills Top 10\n\n**Public review (v1):** Please review and comment on the merged v1 draft in the [Google Doc](https://docs.google.com/document/d/1A5d2OnT8h8oZo7MSde4TOT3sg3AkXJgTGQwVrAga1aE/edit?usp=drivesdk). Previous GitHub issues and pull requests remain available for historical reference, but v1 publication comments should be submitted in the Google Doc.\n\n**Tutorial videos:** Use the [AST10 tutorial video library](/www-project-agentic-skills-top-10/videos?video=ast01) to play each risk video from selectable cards or share direct links with `?video=ast01`\n\nthrough `?video=ast10`\n\n.\n\n## Table of Contents\n\n[Overview](#overview)[📊 Visual Top 10 Overview](/www-project-agentic-skills-top-10/top10)[Tutorial Videos](/www-project-agentic-skills-top-10/videos?video=ast01)[The Problem: A Crisis Already in Progress](#the-problem-a-crisis-already-in-progress)[What Are Agentic Skills?](#what-are-agentic-skills)[Incident Timeline (2026)](#incident-timeline-2026)[Summary Table](#summary-table)[Universal Skill Format Proposal](#universal-skill-format-proposal)[Case Studies](/www-project-agentic-skills-top-10/case-studies.html)[Threat Intelligence](/www-project-agentic-skills-top-10/threat-intelligence.html)[Interactive Risk Assessment Tool](/www-project-agentic-skills-top-10/risk-assessment.html)[Skill Scanner Integration](/www-project-agentic-skills-top-10/skill-scanner-integration.html)[API Documentation](/www-project-agentic-skills-top-10/api-documentation.html)[Skill Development Guide](/www-project-agentic-skills-top-10/skill-development-guide.html)[Platform Comparison](/www-project-agentic-skills-top-10/platform-comparison.html)[Community & Contribution](/www-project-agentic-skills-top-10/community-contribution.html)[Incident Response Playbook](/www-project-agentic-skills-top-10/incident-response.html)[Security Metrics & Monitoring](/www-project-agentic-skills-top-10/metrics-monitoring.html)[Getting Started](#getting-started)[Target Audience](#target-audience)[Project Status and Timeline](#project-status-and-timeline)[Leadership and Governance](#leadership-and-governance)[Key Research and References](#key-research-and-references)[License](#license)\n\n## Overview\n\nThe **OWASP Agentic Skills Top 10 (AST10)** documents the 10 most critical security risks in agentic AI skills across all major AI agent platforms. Skills represent the execution layer that gives agents real-world impact: they define not just what resources agents can access, but *how* they orchestrate multi-step workflows autonomously.\n\nWhile significant attention has been devoted to securing large language models (LLMs) and the Model Context Protocol (MCP) tool layer, the intermediate **behavior layer**—embodied in agentic skills—has emerged as a particularly vulnerable and under-protected component of the AI agent ecosystem. This project exists to close that gap.\n\n**Mental Model**: *MCP = how the model talks to tools; AST10 = what those tools actually do.*\n\n## Quick Security Checklist\n\nUse this checklist to assess your agent skill security posture:\n\n### Registry & Installation\n\n- Only install skills from verified publishers with code signing\n- Enable automated scanning for all skill installations\n- Review skill permissions before installation\n- Pin skill versions to prevent automatic malicious updates\n\n### Runtime Security\n\n- Run agents in isolated environments (containers/sandbox)\n- Implement network restrictions for agent processes\n- Monitor agent file system and network activity\n- Regularly audit installed skills and their dependencies\n\n### Governance & Monitoring\n\n- Maintain inventory of all deployed agent skills\n- Implement approval workflows for skill installations\n- Enable comprehensive audit logging for agent actions\n- Establish incident response procedures for skill compromises\n\n### Development Practices\n\n- Sign all published skills with cryptographic keys\n- Include comprehensive permission manifests\n- Test skills in isolated environments before publishing\n- Document security considerations in skill metadata\n\n*See the complete Security Assessment Checklist for detailed guidance.*\n\n## The Problem: A Crisis Already in Progress\n\nThis is not a theoretical future risk. The AI agent skill ecosystem is under active attack as of Q1 2026.\n\n**By the numbers:**\n\n| Metric | Figure | Source |\n|---|---|---|\n| Skills scanned | 3,984 | Snyk ToxicSkills (Feb 2026) |\n| Skills with security flaws | 1,467 (36.82%) | Snyk ToxicSkills (Feb 2026) |\n| Skills with critical issues | 534 (13.4%) | Snyk ToxicSkills (Feb 2026) |\n| Confirmed malicious payloads | 76+ | Snyk ToxicSkills (Feb 2026) |\n| ClawHavoc campaign: malicious skills | 1,184 | Antiy CERT (Feb 2026) |\n| OpenClaw instances internet-exposed | 135,000+ | SecurityScorecard (Feb 2026) |\n| CVEs disclosed (OpenClaw alone) | 9 (3 with public exploits) | Endor Labs (Feb 2026) |\n| Skills analyzed across all registries | 30,000+ | National CIO Review / Cisco (2026) |\n| Skills containing at least one vulnerability | >25% | National CIO Review (2026) |\n\nThe ClawHub registry—the primary marketplace for OpenClaw skills—became the **first AI agent registry to be systematically poisoned at scale**. Five of the top seven most-downloaded skills at peak infection were confirmed malware. The registry has since implemented automated scanning and partnered with VirusTotal, but the broader ecosystem remains largely unprotected.\n\nCheck Point Research disclosed two critical vulnerabilities in Claude Code (CVE-2025-59536, CVSS 8.7; CVE-2026-21852, CVSS 5.3) demonstrating that **repository-level configuration files now function as part of the execution layer**—simply cloning and opening an untrusted project can trigger remote code execution and API key exfiltration before any user consent dialog appears.\n\nNo comprehensive security framework or dedicated guidance for agent skills existed before this project. That gap is what AST10 addresses.\n\n## What Are Agentic Skills?\n\nAgentic AI skills are reusable, named behaviors that encode complete workflows, including:\n\n- Task understanding and goal decomposition\n- Multi-step planning and tool orchestration\n- File system, network, and shell access\n- Safety guardrails and output formatting\n- Persistent memory and cross-session state\n\nUnlike MCP tools (which define *what* resources and actions are available), skills define *how* to use those tools in sequence to accomplish user goals. This behavioral abstraction layer creates unique security challenges that cannot be addressed by securing either the model or the protocol layer alone.\n\n**The “Lethal Trifecta” (Simon Willison / Palo Alto Networks, 2026):**\nAn AI agent skill is especially dangerous when it simultaneously has:\n\n**Access to private data**(SSH keys, API credentials, wallet files, browser data)** Exposure to untrusted content**(skill instructions, memory files, email)** Ability to communicate externally**(network egress, webhook calls, curl)\n\nMost production agent deployments today satisfy all three conditions.\n\n### Skill Formats by Platform\n\n| Platform | Skill Format | Primary Risk File |\n|---|---|---|\n| OpenClaw | `SKILL.md` (YAML frontmatter + Markdown) |\n`SKILL.md` , `SOUL.md` , `MEMORY.md` |\n| Claude Code | `skill.json` / `YAML` + `scripts/` |\n`.claude/settings.json` , hooks config |\n| Cursor / Codex | `manifest.json` + handler scripts |\n`manifest.json` , tool configs |\n| VS Code | `package.json` + extensions |\n`package.json` , `extension.ts` |\n\n## Incident Timeline (2026)\n\nThe following is a condensed timeline of confirmed real-world incidents involving AI agent skill security, drawn from publicly disclosed research and CVE records.\n\n### January 2026\n\n-\n**Jan 27–29**:** ClawHavoc campaign**launches. Attackers register as ClawHub developers and flood the registry with 341 malicious skills in a 3-day window. All 335 AMOS-delivering skills share a single C2 IP (`91.92.242[.]30`\n\n). Target data includes exchange API keys, wallet private keys, SSH credentials, browser passwords, and`.env`\n\nfiles. Skills also write malicious instructions directly into`MEMORY.md`\n\nand`SOUL.md`\n\nfor session-persistent backdooring. -\n**Jan 31**: ClawHavoc surge peaks. Koi Security names the campaign and begins coordinated removal effort. Some packages persist for weeks.\n\n### February 2026\n\n-\n**Feb 1**: Koi Security publishes first public ClawHavoc analysis. -\n**Feb 3**: Snyk publishes “From SKILL.md to Shell Access in Three Lines of Markdown” threat model, documenting how three lines of markdown in a`SKILL.md`\n\nfile can instruct an agent to read SSH keys and exfiltrate them. -\n**Feb 4**: Alice publishes findings on several published OpenClaw skills found to be actively malicious while in use by over 6,000 users — detected via behavioral analysis. -\n**Feb 5**: Snyk publishes** ToxicSkills**— the first comprehensive security audit of the AI agent skill ecosystem. Key findings: 36% of skills contain security flaws; 13.4% contain critical-level issues; 76 confirmed active malicious payloads; 8 malicious skills still live at time of publication. -\n**Feb 5**: Snyk publishes “280+ Leaky Skills: How OpenClaw & ClawHub Are Exposing API Keys and PII” — a parallel finding showing credential exposure at scale through over-permissioned skills. -\n**Feb 10**: Snyk documents “How a Malicious Google Skill on ClawHub Tricks Users Into Installing Malware” — typosquatting and fake brand impersonation confirmed as active tactics. -\n**Feb 11**: Snyk publishes “Why Your Skill Scanner Is Just False Security (and Maybe Malware)” — demonstrating that pattern-matching scanners miss the majority of critical threats, which rely on natural-language instruction manipulation rather than code signatures. -\n**Feb 14**: OpenClaw patches** log poisoning vulnerability**(version 2026.2.13). Attackers could write malicious content to agent log files via WebSocket requests; since the agent reads its own logs for troubleshooting, injected text could influence decisions and trigger indirect prompt injection. -\n**Feb 25**: Check Point Research publicly discloses** CVE-2025-59536**(CVSS 8.7) and** CVE-2026-21852**(CVSS 5.3) in Claude Code. Both were patched months earlier but the disclosure confirms: repository-controlled configuration files can silently execute arbitrary shell commands and exfiltrate API keys at project open time, before any trust dialog. -\n**Feb 26**:** ClawJacked**disclosed by Oasis Security (CVE-2026-28363, CVSS 9.9). Malicious websites can brute-force localhost WebSocket connections with no rate limiting to silently hijack local OpenClaw instances, register new devices without user prompts, and exfiltrate data through existing agent integrations. OpenClaw patches within 24 hours (version 2026.2.25). -\n**Feb 2026**: Antiy CERT publishes** ClawHavoc Campaign Analysis**, classifying malware as`Trojan/OpenClaw.PolySkill`\n\n. Final tally: 1,184 malicious skills across 12 publisher accounts. Hudson Rock separately identifies Vidar infostealer variants specifically targeting OpenClaw agent identity files (`openclaw.json`\n\n,`device.json`\n\n,`soul.md`\n\n,`memory.md`\n\n). -\n**Feb 2026**: Microsoft Defender Security Research Team issues advisory:*“Because of these characteristics, OpenClaw should be treated as untrusted code execution with persistent credentials. It is not appropriate to run on a standard personal or enterprise workstation.”* -\n**Feb 2026**: BlueRock Security analyzes 7,000+ MCP servers; finds 36.7% potentially vulnerable to SSRF. Proof-of-concept against Microsoft’s MarkItDown MCP server retrieves AWS IAM keys from EC2 metadata endpoint.\n\n### March 2026\n\n-\n**Mar 2026**: SecurityScorecard confirms 135,000+ OpenClaw instances publicly internet-exposed with insecure defaults; 53,000+ correlated with prior breach activity. Bitdefender telemetry confirms employees deploying OpenClaw on corporate devices with no SOC visibility. -\n**Mar 2026**: Snyk and Tessl announce registry-level skill security scanning partnership. Snyk and Vercel previously partnered to scan skills on`skills.sh`\n\nat install time. -\n**NIST / CAISI**: Federal Register RFI on AI Agent Security (published Jan 8, 2026, comments closed Mar 9, 2026) — the first formal US government solicitation specifically addressing AI agent security risks.\n\n### June 2026\n\n-\n**Jun 3**: Trail of Bits publishes “The Sorry State of Skill Distribution” — every public skill scanner tested (ClawHub’s VirusTotal + LLM guard model, Cisco’s`skill-scanner`\n\n, the skills.sh scanners) is bypassed in under an hour, via payload padding that forces truncation, logic hidden in binary and archive formats, and prompt-injecting the scanner’s own LLM judge. -\n**Jun 22–24**: Air Security publishes “The Story of Skills” and “The Circus of Skills” — a researcher-built malicious skill reaches over 26,000 agents while every scanner clears it, its payload served from an attacker-controlled external documentation URL; a follow-up scan of 142,836 live skills finds 17,822 (12.4%, 6.7M installs) resting on at least one untrusted external instruction source.\n\n### July 2026\n\n**Jul 2**: Air Security publishes “SkillJacking” — 925 skills serving ~134K agents sit on instantly hijackable dependencies (deleted GitHub accounts, unregistered packages, expired domains, freed cloud-app slots); researchers take over the most popular video-generation skill on skills.sh (11,483 installs) by re-registering its deleted owner account.\n\n## Summary Table\n\nEach of the 10 risks is documented in a separate file. Click on the risk name to view the full details.\n\n📊\n\nPrefer a visual map?See the— a skill-lifecycle diagram plus a colour-coded card for every risk.[Top 10 Visual Overview]\n\n| # | Risk | Severity | Key Mitigation | Real-World Evidence |\n|---|---|---|---|---|\n|\n\n[AST02](/www-project-agentic-skills-top-10/ast02.html)[AST03](/www-project-agentic-skills-top-10/ast03.html)[AST04](/www-project-agentic-skills-top-10/ast04.html)[AST05](/www-project-agentic-skills-top-10/ast05.html)[AST06](/www-project-agentic-skills-top-10/ast06.html)[AST07](/www-project-agentic-skills-top-10/ast07.html)[AST08](/www-project-agentic-skills-top-10/ast08.html)[AST09](/www-project-agentic-skills-top-10/ast09.html)[AST10](/www-project-agentic-skills-top-10/ast10.html)## MAESTRO Mapping\n\nThe Cloud Security Alliance (CSA) MAESTRO framework provides a structured threat modeling approach for agentic AI systems across 7 interconnected layers. This mapping aligns each AST10 risk with relevant MAESTRO layers to enable targeted threat localization and cross-layer risk analysis.\n\n``` php\ngraph TD\n    A[Layer 7: Agent Ecosystem] --> B[Layer 6: Security & Compliance]\n    B --> C[Layer 5: Evaluation & Observability]\n    C --> D[Layer 4: Deployment & Infrastructure]\n    D --> E[Layer 3: Agent Frameworks]\n    E --> F[Layer 2: Data Operations]\n    F --> G[Layer 1: Foundation Models]\n    \n    style A fill:#ffcccc\n    style B fill:#ffcccc\n    style C fill:#ffffcc\n    style D fill:#ccffcc\n    style E fill:#ccccff\n    style F fill:#ffccff\n    style G fill:#ccffff\n```\n\n| AST | Risk | MAESTRO Layers |\n|---|---|---|\n| AST01 | Malicious Skills | 7, 3, 6, 4, 5 |\n| AST02 | Supply Chain Compromise | 7, 3, 6, 4 |\n| AST03 | Over-Privileged Skills | 6, 4, 3, 7 |\n| AST04 | Insecure Metadata | 7, 3, 4, 6 |\n| AST05 | Untrusted External Instructions | 3, 2, 7, 6 |\n| AST06 | Weak Isolation | 4, 6, 3 |\n| AST07 | Update Drift | 4, 6, 7 |\n| AST08 | Poor Scanning | 5, 6, 3 |\n| AST09 | No Governance | 6, 7, 5 |\n| AST10 | Cross-Platform Reuse | 7, 3, 6 |\n\n*The MAESTRO layer mapping helps teams align AST10 risks with CSA’s 7-layer threat model for agentic AI.*\n\n*For detailed descriptions, attack scenarios, preventive mitigations, and OWASP mappings, see each individual risk file.*\n\n## Contribute\n\nWe welcome contributions from the community! Here’s how you can help:\n\n### Ways to Contribute\n\n**Report New Risks**: Found a security issue in agent skills? Submit it as a GitHub issue with evidence and impact analysis.** Improve Mitigations**: Have better prevention strategies or real-world examples? Update the relevant AST file.** Add Examples**: Share anonymized attack scenarios or mitigation case studies.** Translate**: Help localize this guide for non-English speakers.** Code**: Contribute to scanning tools, format validators, or automation scripts.** Research**: Analyze skills in your environment and share findings (anonymized).\n\n### Getting Started\n\n- Fork the repository on GitHub.\n- Create a feature branch for your changes.\n- Make your edits following our\n[contributing guidelines](/www-project-agentic-skills-top-10/CONTRIBUTING.md). - Submit a pull request with a clear description of your changes.\n\n### Submit New Risk Entries\n\nUse our **interactive web form** to submit new AST risk entries:\n\n**🔀 AST10 metadata loss simulator** — Compare two skill manifests to see which security metadata is lost or weakened after a cross-platform port.\n\nThe form generates properly formatted markdown and provides multiple submission options:\n\n- Direct GitHub file creation\n- Create GitHub Issue\n- Download and manual PR\n\n### Community Guidelines\n\n- Be respectful and constructive in discussions.\n- Provide evidence for security claims.\n- Respect contributor privacy when sharing examples.\n- Follow OWASP’s Code of Conduct.\n\n*See CONTRIBUTING.md for detailed guidelines.*\n\n## Universal Skill Format Proposal\n\nThe following YAML format is proposed as a cross-platform standard that mitigates AST10 and provides the metadata foundation required to address AST01 through AST09. It is designed to be a superset of all current platform-specific formats.\n\n```\n---\n# Universal Agentic Skill Format v1.0\n# Compatible with: OpenClaw, Claude Code, Cursor/Codex, VS Code\n\nname: example-skill\nversion: 1.0.0\nplatforms: [openclaw, claude, cursor, vscode]\n\ndescription: \"Safe example skill — concise, honest statement of function\"\nauthor:\n  name: \"Author Name\"\n  identity: \"did:web:example.com\"         # Decentralized identity anchor\n  signing_key: \"ed25519:pubkey_hex_here\"\n\npermissions:\n  files:\n    read:\n      - ~/.config/app.json                 # Explicit paths only; no wildcards\n    write:\n      - ~/.config/app.json\n    deny_write:\n      - SOUL.md\n      - MEMORY.md\n      - AGENTS.md                          # Identity files require explicit grant\n  network:\n    allow:\n      - api.example.com                    # Domain allowlist, not binary on/off\n    deny: \"*\"                              # Default deny all other egress\n  shell: false                             # Explicit shell access declaration\n  tools:\n    - web_fetch\n    - read_file\n\nrequires:\n  binaries: [jq, curl]\n  min_runtime_version: \"2026.1.0\"\n\nrisk_tier: L1                              # L0=safe, L1=low, L2=elevated, L3=destructive\nscan_status:\n  scanner: \"[email protected]\"\n  last_scanned: \"2026-02-15\"\n  result: \"pass\"\n\nsignature: \"ed25519:ABCDEF1234567890...\"   # Signs the canonical hash of this manifest\ncontent_hash: \"sha256:abcdef1234...\"       # Hash of the complete skill package\n\nchangelog:\n  - version: \"1.0.0\"\n    date: \"2026-02-01\"\n    notes: \"Initial release\"\n---\n```\n\n**Format design rationale:**\n\n`permissions.deny_write`\n\nprotects identity files (`SOUL.md`\n\n,`MEMORY.md`\n\n) by default — must be explicitly overridden.`network.allow`\n\nis a domain allowlist, not a boolean — closing the “network: true” over-permission gap (AST03).`signature`\n\nand`content_hash`\n\ntogether enable Merkle-root registry verification (AST01/AST02).`scan_status`\n\ncreates a machine-readable provenance trail (AST08/AST09).`risk_tier`\n\nenables automated governance policies without per-skill review (AST09/AST10).\n\n## Getting Started\n\n### For Security Teams\n\n- Review this document and the\n[complete Top 10 detail pages](/www-project-agentic-skills-top-10/top10)for full risk descriptions, attack scenarios, and OWASP mappings. - Conduct a skill inventory across all agent platforms in use — treat this as an immediate priority given active exploitation confirmed in 2026.\n- Use the\n[Security Assessment Checklist](/www-project-agentic-skills-top-10/checklist.html)for reviewing installed skills. - Implement the governance framework described in AST09: inventory, approval workflow, audit logging, and agentic identity controls.\n- Subscribe to ClawHub, skills.sh, and platform-specific security advisories.\n\n### For Skill Developers\n\n**Least privilege**: Declare a minimal permission manifest; request only what your skill genuinely needs (AST03).** Safe parsing**: Use safe YAML/JSON loaders; never deserialize untrusted skill configs without sandboxing (AST04).** Sign your skills**: Implement ed25519 signing before publication; include`content_hash`\n\nin your manifest (AST01/AST02).**Pin dependencies**: Lock all nested dependencies to immutable hashes — never version ranges (AST07).** Honest metadata**: Accurately declare`risk_tier`\n\n, permissions, and`requires`\n\n; do not understate scope (AST04).**Protect identity files**: Never request write access to`SOUL.md`\n\n,`MEMORY.md`\n\n, or`AGENTS.md`\n\nunless your skill’s core function requires it — and document why (AST03).\n\n### For Platform Developers\n\n**Default sandbox**: Make container/Docker isolation the default for skill execution; make host-mode an explicit opt-in (AST06).** Safe deserialization**: Disable dangerous YAML/JSON tags in all skill loaders by default; validate against a schema before execution (AST04).** Registry scanning**: Implement behavioral scanning at publish time and at install time; pattern matching alone is insufficient (AST08).** Provenance infrastructure**: Support the Universal Skill Format; implement Merkle-root transparency logs for your registry (AST01/AST02/AST10).** Audit logging**: Emit structured logs for all skill actions (file access, shell commands, network calls, memory writes) (AST09).** Trust prompts**: Do not allow repository-controlled configuration to execute before explicit user trust confirmation (AST02).\n\n## Target Audience\n\n| Role | Primary Concerns | Key AST Risks |\n|---|---|---|\nAI Platform Developers |\nSecure skill runtimes, registries, installers, and CI/CD integration | AST01, AST02, AST04, AST05, AST06, AST08 |\nAppSec / Product Security |\nGovern skills in enterprise deployments; review skill PRs | AST03, AST04, AST05, AST07, AST09 |\nSkill Authors |\nWrite safe manifests, scripts, and metadata; ship signable packages | AST03, AST04, AST05, AST07 |\nGRC / Compliance |\nMap skill risks to NIST AI RMF, ISO 42001, EU AI Act | AST05, AST09, AST10 |\nCISOs / Security Leadership |\nUnderstand blast radius, incident scope, and governance gaps | AST02, AST05, AST06, AST09 |\nDevelopers / Engineers |\nSafely install and use skills without introducing unreviewed risk | AST01, AST02, AST07 |\n\n## Project Status and Timeline\n\n**Status**: New Project Proposal — *active development*\n**Version**: 1.0 (2026 Edition)\n**License**: Creative Commons Attribution ShareAlike 4.0 (CC-BY-SA-4.0)\n\n### Timeline\n\n| Quarter | Phase | Deliverables |\n|---|---|---|\nQ2 2026 |\nFoundation | GitHub repo launch, OWASP project page, AST01–AST06 full write-ups, incident database |\nQ3 2026 |\nCompletion | AST07–AST10 write-ups, Universal Skill Format v1.0 specification, cheat sheets, v1.0 RC |\nQ4 2026 |\nLaunch | v1.0 release, OWASP flagship project submission, RSA 2026 / OWASP Global AppSec presentations |\n\n## Leadership and Governance\n\n### Project Lead\n\n### Co-Leads\n\n### Contribution Model\n\n| Channel | Purpose |\n|---|---|\nGitHub Issues |\nRisk suggestions, new attack scenarios, mitigation proposals |\nGitHub PRs |\nContent contributions, platform-specific examples, translations |\n\n### Goals and Success Metrics\n\n| Goal | Metric | Target |\n|---|---|---|\nv1.0 Release |\nComplete 10 risks + full OWASP/NIST mappings | Q3 2026 |\nOWASP Flagship |\nProject review and approval | Q4 2026 |\nConference Adoption |\nPresentations accepted | 3+ (RSA, OWASP Global AppSec) |\nIndustry Adoption |\nRegistries implementing Universal Skill Format | 2+ major registries |\n\n## Key Research and References\n\n### Primary Research (2026)\n\n**Snyk ToxicSkills**(Feb 5, 2026) — First comprehensive security audit of AI agent skill ecosystem; 3,984 skills scanned across ClawHub and skills.sh.**Snyk: From SKILL.md to Shell Access**(Feb 3, 2026) — Threat model for agent skills; lethal trifecta framework.** Check Point Research: Caught in the Hook**(Feb 25, 2026) — CVE-2025-59536 (CVSS 8.7) and CVE-2026-21852 (CVSS 5.3) in Claude Code.** Antiy CERT: ClawHavoc Campaign Analysis**(Feb 2026) — 1,184 malicious skills;`Trojan/OpenClaw.PolySkill`\n\nclassification.**Oasis Security: ClawJacked**(Feb 26, 2026) — CVE-2026-28363 (CVSS 9.9); WebSocket brute-force against local OpenClaw instances.** SecurityScorecard**(Feb 2026) — 135,000+ OpenClaw instances publicly exposed; 53,000+ correlated with prior breach activity.** Snyk: 280+ Leaky Skills**(Feb 5, 2026) — API key and PII exposure across ClawHub.** Snyk: Why Your Skill Scanner Is Just False Security**(Feb 11, 2026) — Pattern-matching scanner limitations.** Air Security: The Story of Skills**(Jun 22, 2026) — Researcher-built malicious skill reached 26,000+ agents via a trusted marketplace and social media; every scanner cleared it.**Air Security: The Circus of Skills**(Jun 24, 2026) — 142,836 skills scanned for untrusted external instruction sources; 17,822 (12.4%, 6.7M installs) affected.**Air Security: SkillJacking**(Jul 2, 2026) — 925 skills resting on instantly hijackable dependencies (~134K agents); top skills.sh video-generation skill taken over via a deleted GitHub account.\n\n### Industry Reports\n\n**Cisco State of AI Security 2026**— Comprehensive AI threat landscape; agentic AI proliferation and governance gap.** Microsoft Defender Security Research Team**(Feb 2026) — OpenClaw enterprise security advisory.** BlueRock Security**(2026) — 7,000+ MCP server analysis; 36.7% SSRF-vulnerable.** Bitdefender**(Feb 2026) — Enterprise telemetry on shadow AI / OpenClaw deployment.** Hudson Rock**(Feb 2026) — Vidar infostealer variants targeting OpenClaw identity files.** IBM X-Force 2025 Threat Intelligence Index**— AI supply chain risk baseline.\n\n### Standards and Frameworks\n\n**OWASP AIVSS Project**(2025)** OWASP LLM Top 10**(2025)** OWASP Agentic AI Top 10**(Dec 2025)** NIST AI RMF****ISO/IEC 42001**(AI Management System)** EU AI Act**(enforced Aug 2026)** NIST / CAISI Federal Register RFI on AI Agent Security**(Jan 8, 2026)\n\n### Academic and Technical\n\n**“Prompt Injection Attacks on Agentic Coding Assistants”**(arXiv:2601.17548)**“Do Not Mention This to the User”: Detecting and Understanding Malicious Agent Skills in the Wild**(arXiv:2602.06547, USENIX Security 2026)** snyk-labs/toxicskills-goof**— Real malicious skill samples for scanner testing.** openclaw/openclaw Issue #10827**— Skill supply-chain security: provenance tracking and permission manifests proposal.\n\n## Resources\n\n**GitHub**:[github.com/OWASP/www-project-agentic-skills-top-10](https://github.com/OWASP/www-project-agentic-skills-top-10)** OWASP Project Page**:[owasp.org/www-project-agentic-skills-top-10](https://owasp.org/www-project-agentic-skills-top-10/)** Full Risk Documentation**:[Visual Top 10 Overview](/www-project-agentic-skills-top-10/top10)** Project Proposal**:[proposal.md](/www-project-agentic-skills-top-10/proposal.html)** Security Assessment Checklist**:[checklist.md](/www-project-agentic-skills-top-10/checklist.html)** Universal Skill Format Specification**:[universal-skill-format.md](/www-project-agentic-skills-top-10/universal-skill-format.html)\n\n## License\n\nThis work is licensed under a [Creative Commons Attribution-ShareAlike 4.0 International License](https://creativecommons.org/licenses/by-sa/4.0/).\n\nYou are free to share and adapt this material for any purpose, provided you give appropriate credit, provide a link to the license, indicate if changes were made, and distribute your contributions under the same license.\n\n## Contact\n\nFor questions, suggestions, or to get involved:\n\n- Open an issue on GitHub\n\n*Last updated: March 2026. This document reflects confirmed incidents, published CVEs, and research available as of that date. The threat landscape is evolving rapidly — contributions and corrections are welcome.*\n\n## Example\n\nPut whatever you like here: news, screenshots, features, supporters, or remove this file and don’t use tabs at all.\n\n# Leadership & Founding Members\n\n## Project Leadership\n\n### Current Leaders\n\n### Ken Huang\n\n### Hammad Atta\n\n### Fabio Cerullo\n\n### Aonan Guan\n\n### Bhavya Gupta\n\n### Niv Hoffman\n\n### Iftach Orr\n\n### Akram Sheriff\n\n## AIVSS Distinguished Review Board\n\nThe OWASP AIVSS project’s Distinguished Review Board comprises world-renowned cybersecurity leaders, former government officials, and industry pioneers who provide strategic guidance and expert oversight for the AI Vulnerability Scoring System framework. We thank them for their guidance, several of whom have also supported this project’s work.\n\n#### Rob Joyce\n\n*Advisor to PwC and OpenAI, Former Special Assistant to the President and Cybersecurity Coordinator*\n\n#### Jason Clinton\n\n*Deputy CISO, Anthropic*\n\n#### Amy R. Steagall\n\n*Chief Information Security Officer, Stanford University*\n\n#### Martin Stanley\n\n*AI Risk Management Framework Lead, NIST*\n\n#### Apostol Vassilev\n\n*Research Supervisor, NIST*\n\n#### Andrew Coyne\n\n*CISO, Banner Health, Former CISO, Mayo Clinic*\n\n#### Kevin Rocque\n\n*Managing Director/Executive Vice President, Global Technology Risk Officer, TD Bank*\n\n#### Jeff Williams\n\n*Former Global OWASP Chair, Founder and CTO, Contrast Security*\n\n#### Michael Tran Duff\n\n*University Chief Information Security and Data Privacy Officer, Harvard University*\n\n#### Emil Bender Lassen\n\n*Standards Lead, AIUC-1*\n\n## Agentic Skills Top 10 Founding Members\n\nFounding members of the OWASP Agentic Skills Top 10 project itself — project leads, co-leads, and additional contributors — listed alphabetically. Several also contribute to the sibling OWASP AIVSS project listed above.\n\n#### Ken Huang\n\n*Project Lead, Agentic Skills Top 10*\n\n#### Hammad Atta\n\n*Co-Lead, Agentic Skills Top 10*\n\n#### Manish Bhatt\n\n*Security Researcher, AWS*\n\n#### Fabio Cerullo\n\n*Co-Lead, Agentic Skills Top 10*\n\n#### David Girard\n\n*Senior Director, AI Security & AI Alliances, Trend Micro*\n\n#### Aonan Guan\n\n*Co-Lead, Agentic Skills Top 10*\n\n#### Bhavya Gupta\n\n*Co-Lead, Agentic Skills Top 10*\n\n#### Pamela Gupta\n\n*Founder & CEO, OutSecure / Trusted AI*\n\n#### Idan Habler\n\n*Staff AI/ML Security Researcher, Intuit*\n\n#### Niv Hoffman\n\n*CTO, Air Security*\n\n#### Charles Iheagwara\n\n*AI/ML Security Leader, AstraZeneca*\n\n#### Sushmitha Janapareddy\n\n*Director - Security Integrations, American Express*\n\n#### Edward Lee\n\n*Vice President, Lead AI Security, JP Morgan*\n\n#### KJ Lian\n\n*Senior Manager, Data & AI (Public Sector), AWS*\n\n#### Vineeth Sai Narajala\n\n*Application Security, AWS*\n\n#### Iftach Orr\n\n*Co-Lead, Agentic Skills Top 10*\n\n#### Kanna Sekar\n\n*Cyber Security, Google*\n\n#### Akram Sheriff\n\n*Co-Lead, Agentic Skills Top 10*\n\n#### Dennis Xu\n\n*Research VP, AI, Gartner*\n\n## OWASP AIVSS Founding Members\n\nThe [OWASP AIVSS (Agentic AI Vulnerability Scoring System)](https://owasp.org/www-project-agentic-ai-vulnerability-scoring-system/) project is a sibling OWASP initiative focused on scoring the severity of agentic AI vulnerabilities. Its founding members are recognized here as OWASP founding members in the agentic AI security space; many of them have also contributed directly to the Agentic Skills Top 10 project’s research and review process.\n\n#### Sunil Agrawal\n\n*Chief Information Security Officer, Glean*\n\n#### David Ames\n\n*Partner, PwC*\n\n#### Michael Bargury\n\n*Founder and CTO, Zenity*\n\n#### Joshua Beck\n\n*Application Security Architect, SAS*\n\n#### Manish Bhatt\n\n*Security Researcher, Amazon Kuiper Security*\n\n#### Mark Breitenbach\n\n*Security Engineer, Dropbox*\n\n#### Anat Bremler-Barr\n\n*Professor of Computer Science, Tel Aviv University*\n\n#### Siah Burke\n\n*HIPAA Security Officer, Siah.ai*\n\n#### David Campbell\n\n*AI Security, Scale AI*\n\n#### Ying-Jung Chen\n\n*AI safety researcher, PhD, Georgia Institute of Technology*\n\n#### Anton Chuvakin\n\n*Security Solution Strategy, Google*\n\n#### Jason Clinton\n\n*CISO, Anthorphic*\n\n#### Adam Dawson\n\n*Staff AI Security Researcher, Dreadnode*\n\n#### Leon Derczynski\n\n*Principal Research Scientist, NVIDIA*\n\n#### Walker Lee Dimon\n\n*AI Security Researcher, MITRE*\n\n#### Marissa Dotter\n\n*AI Security Researcher, MITRE*\n\n#### Dan Goldberg\n\n*ISO Market Lead, Omnicom*\n\n#### David Haber\n\n*CEO, Lakera*\n\n#### Idan Habler\n\n*Staff AI/ML Security Researcher, Intuit*\n\n#### Jason Haddix\n\n*Founder, Arcanum Information Security*\n\n#### Keith Hoodlet\n\n*Director of AI/ML & AppSec, Trail of Bits*\n\n#### Ken Huang\n\n*AIVSS Project Lead, OWASP*\n\n#### Chris Hughes\n\n*CEO, Aquia*\n\n#### Charles Iheagwara\n\n*AI/ML Security Leader, AstraZeneca*\n\n#### Krystal Jackson\n\n*Researcher, Center for Long-Term Cybersecurity, UC Berkeley*\n\n#### Sushmitha Janapareddy\n\n*Director - Security Integrations, American Express*\n\n#### Rob Joyce\n\n*Former Cybersecurity Director of NSA, Advisor to PwC, PwC*\n\n#### Diana Kelley\n\n*CISO, Noma Security*\n\n#### Prashant Kulkarni\n\n*Lead AI Security Research Engineer, Google Cloud*\n\n#### Mahesh Lambe\n\n*Founder, MIT, Unify Dynamics*\n\n#### Edward Lee\n\n*Vice President, Lead AI Security, JP Morgan*\n\n#### Nate Lee\n\n*CEO, Cloudsec.ai*\n\n#### Vishwas Manral\n\n*CEO, Precize.ai*\n\n#### Daniela Muhaj\n\n*Executive-in-Residence for Research & Development, AI 2030*\n\n#### Vineeth Sai Narajala\n\n*Application Security, AWS*\n\n#### Om Narayan\n\n*AI Security Researcher, AWS*\n\n#### Varun Pant\n\n*Engineering and Product Leader, AI applications at the Automated Reasoning Group, AWS*\n\n#### Advait Patel\n\n*Senior Site Reliability Engineer (DevSecOps + Cloud + AIOps), Broadcom, IEEE*\n\n#### Alex Polyakov\n\n*CEO, adversa.ai*\n\n#### Ramesh Raskar\n\n*Professor & Director, MIT Media Lab*\n\n#### Ron F. Del Rosario\n\n*VP-Head of AI Security, SAP*\n\n#### Tal Shapira\n\n*Co-Founder & CTO, Reco AI*\n\n#### Akram Sheriff\n\n*Senior AI/ML Software Engineering Leader, Cisco*\n\n#### Samantha Siau\n\n*Security and Compliance, Anthropic*\n\n#### Kevin Simmonds\n\n*Partner on AI Offensive Security, PWC*\n\n#### Martin Stanley\n\n*NIST AI RMF Lead, Independent*\n\n#### Omar A. Turner\n\n*General Manager of Security, Microsoft*\n\n#### Apostol Vassilev\n\n*AI Research Team Supervisor, NIST*\n\n#### Matthew Versaggi\n\n*AI Fellow, White House Presidential Innovation Fellow*\n\n#### David Webb\n\n*Agency Cybersecurity Officer, Cybersecurity and Infrastructure Security Agency*\n\n#### Dennis Xu\n\n*Research VP, AI, Gartner*\n\n#### Xiaochen Zhang\n\n*Executive Director and Chief Responsible AI Officer, AI 2030*\n\n### Recognition\n\nWe extend our gratitude to all founding members who have contributed to establishing this crucial framework for AI security assessment. Their vision and dedication have been instrumental in shaping the Agentic Skills Top 10 project.\n\n## Get Involved\n\nInterested in contributing to the Agentic Skills Top 10 project? We welcome new contributors and leaders. Please see our [Contribution Guidelines](CONTRIBUTING.md) for more information on how to get involved.", "url": "https://wpnews.pro/news/owasp-agentic-skills-top-ten", "canonical_source": "https://owasp.org/www-project-agentic-skills-top-10/", "published_at": "2026-08-27 19:38:22+00:00", "updated_at": "2026-08-27 19:49:15.857582+00:00", "lang": "en", "topics": ["ai-safety", "ai-policy", "ai-agents", "ai-tools"], "entities": ["OWASP Foundation", "OpenClaw", "Claude Code", "Cursor", "Codex", "VS Code"], "alternates": {"html": "https://wpnews.pro/news/owasp-agentic-skills-top-ten", "markdown": "https://wpnews.pro/news/owasp-agentic-skills-top-ten.md", "text": "https://wpnews.pro/news/owasp-agentic-skills-top-ten.txt", "jsonld": "https://wpnews.pro/news/owasp-agentic-skills-top-ten.jsonld"}}