Skills are the part of the agentic stack that quietly got the most power and the least scrutiny. A skill is a folder of markdown and scripts that tells an agent how to run a multi-step workflow, and the agent follows it with your credentials, your filesystem, and your network access.
OWASP's Agentic Skills Top 10 (AST10) is the first structured threat model for that layer. The mental model the project uses is worth stealing: MCP defines how models talk to tools; AST10 defines what tools actually execute.
It's version 1.0, 2026 Edition, still in active development, led by Ken Huang with eight co-leads. The full v1.0 launch and OWASP flagship submission is targeted for Q4 2026.
| ID | Risk | What it means |
|---|---|---|
| AST01 | Malicious Skills | Skills built to do harm, shipped as helpful ones |
| AST02 | Supply Chain Compromise | A trusted skill's upstream gets owned |
| AST03 | Over-Privileged Skills | Skills asking for far more access than the job needs |
| AST04 | Insecure Metadata | Frontmatter and manifests as a payload delivery channel |
| AST05 | Untrusted External Instructions | Skills fetching behavior from sources nobody verified |
| AST06 | Weak Isolation | No real sandbox between the skill and the host |
| AST07 | Update Drift | The skill you audited is not the skill running today |
| AST08 | Poor Scanning | Pattern-matching scanners that miss what matters |
| AST09 | No Governance | No inventory, no approvals, no audit log, no owner |
| AST10 | Cross-Platform Reuse | One malicious skill, ported across every registry |
The project documents 280+ leaked credentials traced to skills holding permissions they never needed. This is the classic problem, just with a new blast radius: a skill that only needs to read one directory gets handed the whole home folder, and every secret in it becomes reachable the moment anything goes wrong.
Ask of every skill you install: what is the smallest set of tools this needs? If the answer is "all of them," that's the finding.
A skill that fetches a prompt, a config, or a script at runtime is a skill whose behavior you cannot audit. You reviewed the file on disk. The file on disk says curl something and follow it. Prompt injection stops being a theoretical concern and becomes the actual control flow.
The project cites 135K+ exposed OpenClaw instances as the illustration. The pattern generalizes: agent runtimes get deployed with default network exposure and no sandbox, then handed skills that assume a trusted environment.
You audit v1.2. The registry serves v1.9 tomorrow. Nothing in the default install flow tells you. The mitigation OWASP points at is boring and effective, e.g. immutable pinning and hash verification and almost nobody does it because skill registries make installation one command and pinning zero commands.
The uncomfortable one. Skills are mostly natural language, and instructions hidden in prose don't look like anything a regex was built to catch. A scanner that greps for eval and subprocess will pass a skill whose entire attack is a paragraph telling the model what to do next.
If you're installing skills from anywhere but your own repo:
SKILL.md. Including the ones that look like documentation.The project takes submissions for new AST entries through a web form on the project site, and the usual fork-branch-PR flow on GitHub for edits. They're also asking for anonymized research findings, mitigation improvements, translations, and tooling.
License is CC BY-SA 4.0, so you can build on it.
Project page: owasp.org/www-project-agentic-skills-top-10