OWASP Agentic Skills Top 10 (AST10): The Complete Security Framework For AI Agent Skills + Video

Introduction:

Agentic AI skills—the reusable behavior packages that define what an AI agent can do and how it orchestrates multi-step workflows—have become the fastest-growing and most under-protected attack surface in modern AI deployments. While the industry has focused heavily on securing large language models (LLMs) and the Model Context Protocol (MCP) tool layer, the intermediate behavior layer embodied in agentic skills has emerged as a particularly vulnerable component. The OWASP Agentic Skills Top 10 (AST10), released in 2026, documents the ten most critical security risks in AI agent skills across platforms including OpenClaw, Claude Code, Cursor/Codex, and VS Code. With over 3,984 skills scanned, 36.82% containing security flaws, and 76+ confirmed malicious payloads already in the wild, this is not a theoretical future risk—it is an active crisis unfolding in real time.

Learning Objectives & Secrets:

Objective 1: Master the AST10 Risk Taxonomy — Understand all ten critical risks (AST01–AST10), their severity ratings, and platform-specific attack scenarios. This framework spans the full skill lifecycle from authoring and publishing to installation, execution, and governance.
Objective 2: Implement Cryptographic Signing and Provenance Controls (Secret Tip) — Require Ed25519 cryptographic signatures on all published skills and reject unsigned installations. Bind each signature to a resolvable, revocable publisher identity such as a domain or DID, and implement Merkle root signing for skill registries to provide tamper-evident audit trails.
Objective 3: Deploy Defense-in-Depth with Scanning and Sandboxing (Secret Tip) — Never rely on a single control. Layer cryptographic signing with behavioral scanning (not just pattern matching), containerized isolation, network restrictions, and immutable version pinning. Use tools like NVIDIA SkillSpector for pre-installation static and semantic analysis.

You Should Know:

AST01—Malicious Skills: Detecting and Blocking Malicious Skill Payloads

Malicious skills represent the most direct and dangerous risk in the agentic skill ecosystem. Attackers publish skills that appear legitimate—claiming to integrate with search, email, documents, or databases—while actually using the agent’s privileges to read files, exfiltrate keys, write to memory, and establish outbound network communication. The ClawHavoc campaign alone deployed 1,184 malicious skills.

Step-by-Step Guide to Mitigating Malicious Skills:

Step 1: Enforce Cryptographic Signing. Require Ed25519 signatures on all published skills and reject unsigned installations. Generate a key pair and sign skills at publish time:

 Generate Ed25519 key pair
openssl genpkey -algorithm ed25519 -out publisher_private.pem
openssl pkey -in publisher_private.pem -pubout -out publisher_public.pem

Sign a skill manifest (SKILL.md) with Ed25519
openssl pkeyutl -sign -inkey publisher_private.pem -rawin -in SKILL.md -out SKILL.md.sig

Verify the signature before installation
openssl pkeyutl -verify -pubin -inkey publisher_public.pem -rawin -in SKILL.md -sigfile SKILL.md.sig

Step 2: Implement Behavioral Scanning. Use tools like SkillSpector (Apache-2.0) to scan skills before installation. SkillSpector combines fast static checks with optional LLM semantic analysis and returns a 0–100 risk score with severity labels:

 Install SkillSpector
git clone https://github.com/NVIDIA/SkillSpector
cd SkillSpector
pip install -e .

Scan a skill directory (static analysis only)
skillspector scan ./skills/my_skill/ --1o-llm

Scan with LLM semantic analysis for deeper inspection
skillspector scan ./skills/my_skill/ --llm --risk-threshold 30

Step 3: Hash-Pin Installed Skills. After verification, hash-pin installed skills and alert on any modification to detect tampering:

 Generate SHA-256 hash of installed skill
sha256sum ./installed_skills/my_skill/SKILL.md > my_skill.hash

Verify integrity before each execution
sha256sum -c my_skill.hash

AST02—Supply Chain Compromise: Securing the Skill Distribution Pipeline

Supply chain compromise occurs when a skill is poisoned during distribution—through registry compromise, dependency poisoning, or publisher identity theft. OWASP rates this as CRITICAL and recommends registry transparency, provenance tracking, and dependency analysis.

Step-by-Step Guide to Supply Chain Security:

Step 1: Verify Publisher Identity. Only install skills from verified publishers with code signing. Maintain a trusted publisher allowlist and verify each signature against a known public key:

 Maintain a trusted keyring
gpg --import trusted_publishers.asc
gpg --verify SKILL.md.sig SKILL.md

Step 2: Implement Registry Transparency. Use Merkle root signing for skill registries to create tamper-evident logs of all published skills:

 Example: Verify a skill against a registry Merkle root
 (Implementation depends on registry API)
curl https://registry.example.com/api/v1/skills/my-skill/proof
 Verify the inclusion proof against the published Merkle root

Step 3: Pin Skill Versions. Prevent automatic malicious updates by pinning skill versions and reviewing updates before deployment:

 In your agent configuration, pin to a specific version
{
"skills": {
"my-skill": {
"version": "1.2.3",
"hash": "sha256:a1b2c3...",
"source": "https://registry.example.com/skills/my-skill/1.2.3/"
}
}
}

3. AST03—Over-Privileged Skills: Implementing Least Privilege

Over-privileged skills request far more permissions than they actually need—a skill that only needs to read one API endpoint might request full directory access, open network outbound, or write access to memory and identity files. Snyk’s February 2026 report identified 280+ skills leaking credentials due to excessive permissions.

Step-by-Step Guide to Permission Hardening:

Step 1: Define Explicit Permission Manifests. Use schema validation to enforce least-privilege manifests. OWASP’s Universal Skill Format includes `deny_write` as a default protection and recommends network allowlists rather than a simple network: true:

 Example: Least-privilege skill manifest (YAML)
name: my-skill
version: 1.0.0
permissions:
filesystem:
read: ["/data/allowed/"]
write: []  Explicitly empty - no write access
deny_write: true  OWASP recommended default
network:
allow: ["api.example.com:443"]
 No wildcard or "true" - explicit allowlist only
secrets:
access: []  No secret access unless explicitly required
memory:
read: false
write: false

Step 2: Audit Permission Requests. Review skill permissions before installation and flag any that exceed the minimum required for the skill’s function:

 Extract and review permissions from a skill manifest
cat SKILL.md | grep -A 20 "^permissions:"
 Or use skill-lint for automated permission checking
npx skill-lint ./skills/my_skill/ --check-permissions

Step 3: Runtime Enforcement. Run agents with runtime permission enforcement that blocks any action outside the declared manifest.

4. AST06—Weak Isolation: Sandboxing and Containerization

Weak isolation allows a compromised skill to escape its execution environment and impact the host system or other agents. OWASP rates this as HIGH and recommends containerization and sandboxing.

Step-by-Step Guide to Isolation Hardening:

Step 1: Run Agents in Isolated Containers. Use container runtimes like Docker with minimal privileges:

 Run an agent in a container with restricted capabilities
docker run --rm \
--cap-drop=ALL \
--cap-add=NET_BIND_SERVICE \
--read-only \
--tmpfs /tmp:rw,noexec,nosuid,size=100m \
--1etwork=none \
--security-opt=no-1ew-privileges:true \
my-agent-image

Step 2: Implement Network Restrictions. Use network policies to restrict agent outbound communication:

 Docker network restriction - only allow specific egress
docker network create --internal agent-1et
 Or use iptables for fine-grained control
iptables -A OUTPUT -m owner --uid-owner agent -d 192.168.1.0/24 -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner agent -j DROP

Step 3: Monitor File System and Network Activity. Implement continuous monitoring of agent processes:

 Monitor file system changes in real-time
inotifywait -m -r /agent/workspace/

Monitor network connections
ss -tunap | grep agent-pid

Audit all agent actions with comprehensive logging
auditctl -a always,exit -S execve -k agent-exec
auditctl -a always,exit -S openat -k agent-files

5. AST07—Update Drift: Immutable Pinning and Hash Verification

Update drift occurs when skills are automatically updated without review, potentially introducing malicious changes. OWASP rates this as MEDIUM and recommends immutable pinning and hash verification.

Step-by-Step Guide to Preventing Update Drift:

Step 1: Pin All Skill Versions. Never use “latest” or wildcard version specifiers:

{
"dependencies": {
"skills": {
"data-processor": "2.1.0", // Exact version, not "^2.1.0" or "latest"
"web-scraper": "1.0.3"
}
}
}

Step 2: Verify Hashes Before Loading. Chain the hashes of all referenced files so you can detect if any single file was modified post-signing:

 Generate and verify a hash chain
find ./skill/ -type f -exec sha256sum {} \; | sort -k2 > skill.manifest
sha256sum -c skill.manifest

Step 3: Implement Update Approval Workflows. Require manual review and approval for all skill updates:

 Example: Compare current and new versions before approval
diff <(curl -s https://registry.example.com/skills/my-skill/1.0.0/SKILL.md) \
<(curl -s https://registry.example.com/skills/my-skill/1.0.1/SKILL.md)
 Review changes, then approve with digital signature

What Undercode Say:

Key Takeaway 1: The Skill Layer Is the New Attack Surface. The industry has spent years securing LLMs and MCP tools, but the skill layer—where natural language instructions blend with executable code and full agent privileges—has been largely ignored. The 36.82% vulnerability rate across scanned skills proves this is not a theoretical concern. Every organization deploying AI agents must immediately inventory their deployed skills and implement the AST10 controls.
Key Takeaway 2: Defense Requires Layered Composition. No single control is sufficient. Effective defense requires cryptographic signing for integrity, behavioral scanning for malicious intent, least-privilege manifests for permission control, containerization for isolation, immutable pinning for update security, and governance for visibility. The OWASP AST10 framework provides the blueprint for this layered approach, mapping each risk to specific, actionable mitigations.

Prediction:

+1 The OWASP AST10 framework will become the de facto standard for AI agent skill security within 12-18 months, similar to how the OWASP Top 10 became the benchmark for web application security. Organizations that adopt AST10 early will gain a significant competitive advantage in AI governance and compliance.
+1 The emergence of automated skill scanners like NVIDIA SkillSpector and the OWASP-maintained AST10 scanner will dramatically reduce the barrier to entry for skill security, enabling widespread adoption of pre-installation scanning across the developer ecosystem.
-1 The attack surface will continue to expand as more organizations deploy AI agents without proper security controls. With over 135,000 OpenClaw instances internet-exposed and 9 CVEs already disclosed in OpenClaw alone, we can expect a significant increase in skill-based attacks targeting enterprise AI deployments.
-1 The cross-platform reuse risk (AST10) will become increasingly critical as skills are ported between OpenClaw, Claude Code, Cursor, and VS Code without translating security properties. A single poisoned skill reused across platforms could create a cascading supply chain compromise affecting thousands of deployments.
+1 Regulatory frameworks like NIST AI RMF and ISO 42001 will begin referencing AST10 as a compliance benchmark, accelerating enterprise adoption and creating a market for AST10-certified skills and skill registries.
-1 The “shadow AI” problem—where developers install skills without SOC visibility, approval workflows, or revocation mechanisms—will worsen before it improves. Organizations must prioritize governance (AST09) and establish formal skill approval workflows, inventories, and audit trails to prevent uncontrolled skill proliferation.

▶️ Related Video (80% Match):

https://www.youtube.com/watch?v=4Ek5h3mKqQ8

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: https://lnkd.in/p/e8dBYfG8 – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Listen to this Post