OWASP Agentic Skills Top 10: Risks and Controls for AI Skills

The OWASP Agentic Skills Top 10 is a 2026 list of security risks in reusable skill packages that tell AI agents how to complete tasks and use tools. Its entries cover malicious packages, supply chain compromise, excessive privilege, unsafe metadata, external instructions, weak isolation, update drift, poor scanning, missing governance, and cross-platform reuse.

The official OWASP Agentic Skills Top 10 is an incubator project whose v1 draft is under public review. It covers skill formats used across agent platforms, including instruction files, manifests, scripts, and package metadata. Teams should record the version they review because the project may revise names or guidance.

A skill is neither a prompt nor an MCP server, though it may contain instructions that call MCP tools. It packages behavior, supporting files, code, and declared capabilities into something an agent can discover and reuse. Installation can therefore introduce both natural-language instructions and executable supply chain risk.

Key Takeaways

• Treat every skill package as untrusted software and untrusted instruction content until its source, code, behavior, and permissions have been reviewed.
• Resolve declared capabilities into enforceable runtime policy instead of trusting metadata or prose descriptions.
• Pin approved versions, verify integrity, isolate execution, and review every update before it changes agent behavior.
• Maintain an inventory with owner, source, version, permissions, dependencies, users, audit events, and a tested revocation path.

What Agentic Skills Add to the AI Attack Surface

A skill can describe a complete workflow rather than one tool call. It may tell an agent how to decompose a task, read files, invoke commands, contact services, process output, and decide when work is complete. That sequence can combine several ordinary permissions into a larger effect.

Skill packages can arrive from registries, repositories, copied folders, vendor extensions, project templates, or local configuration. A familiar name does not prove who published the package or what version is running. The installer and agent host need provenance and policy that survive naming and presentation changes.

Natural-language instructions complicate scanning because dangerous behavior may be expressed as plausible operational guidance. Code analysis can miss an instruction that tells the agent to upload secrets, while text analysis can miss a helper script that opens a reverse shell. Review needs both representations and their combined behavior.

OWASP Agentic Skills Top 10 Risks Explained

AST01: Malicious skills

A malicious skill presents itself as useful while stealing credentials, modifying files, installing persistence, executing commands, or redirecting the agent. Harmful behavior may live in code, metadata, referenced instructions, or a workflow step that looks necessary to the stated task.

Verify the publisher and source, inspect all package contents, and test behavior in a restricted environment. Compare the skill’s observed file, network, process, and credential access with its stated purpose. Reject packages that hide code, download unpinned payloads, or request authority unrelated to the task.

AST02: Supply chain compromise

A legitimate skill can become malicious after a maintainer account, registry, repository, build process, or update channel is compromised. Popularity and an earlier review do not establish the safety of a later release.

Pin a reviewed version or immutable revision, verify signatures or digests, and preserve the reviewed artifact in an approved store. Protect publishing identities and require controlled release workflows. An update should trigger fresh code, instruction, metadata, dependency, and permission review.

AST03: Over-privileged skills

Skills may receive broad filesystem, shell, network, browser, repository, or cloud access because the platform grants one shared agent context. Prompt injection or a malicious input can then use the skill’s legitimate permissions for another purpose.

Give a skill only the capabilities and resources its workflow needs. Separate reading from writing, scope destinations and directories, use temporary credentials, and require confirmation before consequential actions. The AI agent authorization guide explains how tool access and delegated authority should be bound to each task.

AST04: Insecure metadata

Skill metadata can misstate identity, publisher, permissions, dependencies, compatible platforms, update sources, or intended behavior. A registry or host that trusts these fields may surface an impersonating package or grant authority without checking the package itself.

Validate metadata against a strict schema and authenticated publisher record. Treat display names, descriptions, icons, and search tags as presentation rather than trust evidence. Resolve requested capabilities into explicit policy and show the user the actual permissions before installation.

AST05: Untrusted external instructions

A small local skill may point to remote documentation, scripts, templates, examples, or policy text that can change without a new package version. The remote source can later replace benign content with instructions that redirect the agent or expose data.

Include reviewed instructions inside the pinned package where possible. If remote content is necessary, restrict the origin, verify content integrity, cache an approved copy, and treat fetched text as untrusted data. A mutable web page should never silently expand skill authority.

AST06: Weak isolation

A skill running in the agent host’s full security context can inherit local files, environment variables, browser sessions, network reach, and process execution. One compromised package can then access far more than the workflow needs.

Run skills in restricted, disposable environments with explicit mounts and network policy. Drop operating-system privilege, separate secrets, limit processes and resources, and prevent one skill from reading another skill’s state. Isolation should remain effective even if the agent follows every malicious instruction in the package.

AST07: Update drift

Update drift occurs when a skill changes after approval without an equivalent security review. Floating branches, mutable tags, automatic registry updates, remote scripts, and unpinned dependencies can all change behavior under the same skill name.

Record the exact package and dependency versions used in each run. Block automatic movement to an unreviewed release and compare instructions, code, metadata, permissions, and dependencies during upgrade. Preserve rollback and remove superseded vulnerable versions from the allowed catalog.

AST08: Poor scanning

Traditional malware and source scanners may examine code while ignoring instructions and manifests. An LLM-only review may accept persuasive prose or fail to follow a multi-file execution path. Obfuscation, generated commands, and downloaded content create further gaps.

Combine static code checks, secret detection, dependency analysis, metadata validation, instruction analysis, and sandboxed behavior observation. Test hostile inputs that exercise hidden branches. Keep human review for skills with privileged actions or ambiguous purpose.

AST09: No governance

Without inventory and policy, teams cannot answer which skills are installed, who approved them, which users run them, or how to disable them. Developers may copy packages locally and retain them after the owner or project disappears.

Maintain an approved catalog and discover local installations and configuration. Assign owners, approval state, review date, expiry, data classification, and permitted environments. Central revocation should prevent new runs and remove credentials without waiting for every user to update a workstation.

AST10: Cross-platform reuse

Porting a skill between agent platforms can lose permission declarations, sandbox assumptions, confirmation hooks, path rules, or update controls. Equivalent-looking manifests may have different meanings, and a format conversion can keep instructions while dropping safeguards.

Review the skill against the destination platform rather than treating conversion as a mechanical step. Map capabilities, identity, filesystem, network, tools, approvals, persistence, and updates explicitly. Test the converted package under destination defaults and document controls that cannot be carried over.

Skill Security Should Follow the Full Lifecycle

Review begins before installation. Capture the source, publisher, artifact, dependencies, requested capabilities, external references, supported platforms, and stated workflow. Preserve the exact reviewed version so an investigator can reproduce what the agent received.

At load time, verify integrity and policy again. A package that was approved for a disposable development environment may be unsafe on a workstation with production credentials. Runtime policy should consider the current user, task, data, environment, and target resource.

Execution records need more than a skill name. Log the package version, initiating identity, delegated authority, files and services accessed, tools invoked, approvals, outputs, and denied actions. After retirement, revoke credentials and remove the package from registries and local environments.

How to Test an Agentic Skill

Start with a clean environment and observe installation and initialization. Record created files, subprocesses, network calls, dependencies, registry queries, environment reads, and credential requests. Repeat the test without optional permissions to see whether the skill fails safely.

Then use hostile task content. Place conflicting instructions in documents, repository files, web pages, tool results, and external references that the skill is expected to read. The skill should not expand its goal, disclose unrelated data, or bypass approval because input text claims a new requirement.

Test changes and containment. Replace an external document, publish a modified dependency, alter metadata, revoke a credential, disable network access, and interrupt execution mid-workflow. Confirm that the host detects drift, stops safely, preserves evidence, and avoids duplicate side effects.

Agentic Skills, MCP, and Agentic Applications Cover Different Layers

The OWASP MCP Top 10 guide focuses on servers, tools, tokens, context, and protocol integration. The OWASP Agentic AI Top 10 guide covers goal hijack, identity abuse, memory, communication, cascading failure, and rogue agents. The skills list focuses on reusable behavior packages and their lifecycle.

One attack can cross all three. A compromised skill can redirect an agent goal, then invoke an over-privileged MCP tool. Teams should map each list to the same data flow and remove duplicate controls rather than operating three disconnected reviews.

Frequently Asked Questions

Is the OWASP Agentic Skills Top 10 final?

The project identifies itself as an OWASP incubator project with a v1 draft under public review. Teams can use it as a current review framework while tracking revisions. It is not a complete agent security standard or a substitute for platform-specific threat modeling.

What is an agentic skill?

An agentic skill is a reusable package of instructions, metadata, supporting files, or code that teaches an AI agent how to perform a workflow. It may call tools, access resources, and coordinate several steps. Its exact format and execution model depend on the agent platform.

Can antivirus scanning prove an AI skill is safe?

Antivirus may detect known malicious files, but a harmful workflow can be written as natural-language instructions or assembled from legitimate tools. Skill review must examine code, metadata, dependencies, referenced content, permissions, and observed behavior. Privileged packages also need human review and runtime isolation.

Should skills update automatically?

Automatic updates can replace an approved skill with code or instructions that have not been reviewed. Production and privileged environments should pin reviewed versions and require controlled upgrades. Emergency security updates still need integrity checks, scoped testing, and a rollback path.