Key Insights
Many of the most damaging attacks of the past decade share one logic. Attackers stopped trying to break through controls and started using something the organization already trusted: a vendor's email thread, an executive's name, an employee's login. Defenses built to catch known-bad indicators had little to say about an attack that looked like normal business.
AI agents give that logic a new place to work. Agents take direction from skills, reusable files that tell them how to plan a task, which tools to call, and where to send the results. Whoever writes a skill can influence how an agent approaches tasks, invokes tools, and handles information, within the permissions and controls of its environment.
OWASP's Agentic Skills Top 10 catalogs the ten most critical risks at that layer. Read closely, it is a cybersecurity story well beyond AI agents, and it says a good deal about how defense has to change.
What Is the OWASP Agentic Skills Top 10?
The OWASP Agentic Skills Top 10 is an OWASP incubator project whose first version is in public review. It documents the ten most critical security risks in agent skills across the major ecosystems, including OpenClaw, Claude Code, Cursor and Codex, and VS Code. OWASP labels the risks AST01 through AST10.
Skills are reusable, named behaviors that encode complete workflows: breaking a goal into steps, orchestrating tools, touching files, networks, and shells, and keeping memory across sessions. OWASP offers a simple mental model for where they sit. The Model Context Protocol covers how a model talks to its tools, and the skills list covers what those tools go on to do.
The evidence behind the list is already substantial. Antiy CERT counted 1,184 malicious skills in a single campaign against the ClawHub registry. Snyk's ToxicSkills audit examined 3,984 skills, finding security issues in 1,467 (36.82%), including 534 with critical issues. Researchers also confirmed 76 malicious payloads. Snyk also showed that three lines of markdown in a SKILL.md file can instruct an agent to read a user's SSH keys and send them out.
The OWASP Agentic Skills Top 10 List
OWASP rates the ten risks from critical to medium severity. The table below summarizes each one.
ID | Risk | Severity | What it means |
|---|---|---|---|
AST01 | Malicious Skills | Critical | Skills built to steal credentials, data, or access |
AST02 | Supply Chain Compromise | Critical | A trusted source or registry becomes the way in |
AST03 | Over-Privileged Skills | High | Skills granted more access than their job requires |
AST04 | Insecure Metadata | High | Names, descriptions, and publisher details trusted without verification |
AST05 | Untrusted External Instructions | High | Skills that follow outside content that can change |
AST06 | Weak Isolation | High | Skills running with direct access to the host |
AST07 | Update Drift | Medium | A skill, or something it depends on, changes after approval |
AST08 | Poor Scanning | Medium | Checks that miss attacks written in natural language |
AST09 | No Governance | Medium | No inventory, approval process, or audit trail for skills |
AST10 | Cross-Platform Reuse | Medium | Skills ported between platforms lose security information |
What the Agentic Skills Top 10 Says About Cybersecurity as a Whole
The Attack Arrives Through Something Already Trusted
Look across the ten risks: a skill from a popular registry, a documentation link a reviewer approved, a publisher name that looks like Google. Each of these worked by using trust the organization had already extended.
Email attackers learned this years ago: a vendor invoice thread, a spoofed executive, a login that looks like the employee's. The delivery changes and the logic stays the same. When attackers can get invited in, the defender's question shifts from "is this known to be bad?" to "is this behaving like itself?"
The Identity Perimeter Now Includes Agents
An agent acts with an employee's credentials. When a skill changes what the agent does, the identity does not change at all: same login, same permissions, same API keys. Traditional identity checks may still succeed because the agent is operating with valid credentials, even when its behavior has been manipulated
This is why OWASP's governance risk calls for agentic identity controls, and it is how we think about the problem at Abnormal AI. Employees, vendors, service accounts, OAuth apps, and now AI agents are all identities, and each one has a normal pattern of behavior. A baseline for each identity shows when it starts acting like someone else.
Point-in-Time Approval Cannot Keep Up
Scanners, allowlists, and reputation scores each answer a question at a single moment. The Air Security research shows the gap: a skill cleared on Monday can point to a page that says something different by Friday. Security teams know this pattern from vendor risk. A supplier that passed review last quarter can be compromised today, and the invoice it sends will look normal.
Trust decisions need to keep running after the approval.
Behavior Is the Control That Scales
Behavioral detection adds a critical layer of protection that static checks alone cannot provide. While scanning, permission controls, and sandboxing help reduce exposure, continuous behavioral analysis can identify suspicious activity after a skill has been approved or deployed.
Together, these controls help organizations detect threats that exploit legitimate access without relying solely on known malicious indicators.
Skills Will Not Be the Last Layer
Skills are one layer of agent extensibility. Plugins, connectors, and shared memory follow the same pattern: text that tells an agent what to do, supplied by someone outside the organization. We expect each to attract the same kind of attack, and the same answer to apply. Organizations that build visibility into agent behavior now will not need to rebuild it for each new layer.
What Security Leaders Should Do Now
For CISOs, skill risk is a governance question before it is a tooling question: who approved each agent, and what can it reach? For application security and product security leaders, skills belong in the same review process as third-party dependencies, including every external URL a skill relies on. For SOC leaders, agent activity needs the same baselines and alerting as user activity.
OWASP's guidance for security teams opens with an inventory and treats it as an immediate priority. A practical sequence from there:
Inventory every skill installed across your agent platforms, and record who approved each one.
Pin skill versions and list every external URL or dependency each skill relies on, so changes get noticed.
Cut permissions to what each skill needs: explicit file paths, a network allowlist, and no shell access unless the skill requires it.
Run agents in containers or sandboxes instead of directly on workstations.
Log agent actions across files, shell, network, and memory, and baseline what normal looks like so deviations stand out.
Abnormal AI is extending its behavioral security approach to AI agents, with capabilities designed to help organizations discover agents, understand their access, establish behavioral baselines, and identify activity that deviates from expected behavior. By connecting agent activity with identity and access context, Abnormal aims to help security teams detect and contain threats that traditional security controls may miss.
Learn More About Abnormal AI Agent Security
Frequently Asked Questions
What is the OWASP Agentic Skills Top 10?
It is an OWASP incubator project that documents the ten most critical security risks in agent skills, the reusable workflows that tell an AI agent how to use its tools. Its first version is in public review.
What are the ten risks in the OWASP Agentic Skills Top 10?
They are Malicious Skills, Supply Chain Compromise, Over-Privileged Skills, Insecure Metadata, Untrusted External Instructions, Weak Isolation, Update Drift, Poor Scanning, No Governance, and Cross-Platform Reuse, labeled AST01 through AST10.
How is it different from the OWASP Top 10 for Agentic Applications?
The applications list covers risks across agent systems, including goal hijacking, tool misuse, and identity abuse. The skills list narrows to the skill layer, where reusable workflows determine what an agent does with its tools.