OWASP Agentic Skills Top 10

What it is

The OWASP Agentic Skills Top 10 (AST10), a public-review v1 draft framework for security risks in AI agent "skills" — reusable named behaviors that orchestrate multi-step workflows (planning, file/network/shell access, persistent memory). It spans four skill formats: OpenClaw (SKILL.md YAML), Claude Code (skill.json), Cursor/Codex (manifest.json), and VS Code (package.json). Its framing: MCP defines what tools an agent can call; skills define how they are chained — an under-protected behavior layer the page argues is under active attack as of Q1 2026.

How it works

The page anchors its case in disclosed incidents. The ClawHavoc campaign (Jan 27–29, 2026) flooded the ClawHub registry with 341 malicious skills in three days; 335 AMOS-delivering skills shared one C2 IP (91.92.242[.]30). Payloads harvested exchange API keys, wallet private keys, SSH credentials, browser passwords, and .env files, and wrote persistent backdoor instructions into MEMORY.md and SOUL.md for cross-session compromise. At peak, five of ClawHub's top seven most-downloaded skills were confirmed malware. Snyk's "SKILL.md to Shell Access in Three Lines of Markdown" showed three markdown lines instructing an agent to read and exfiltrate SSH keys.

The governing risk model is the Lethal Trifecta (Simon Willison / Palo Alto Networks, 2026): danger arises when a skill simultaneously has (1) access to private data, (2) exposure to untrusted content, and (3) external egress. The page claims most production deployments meet all three.

Preconditions / Affected

Check Point Research disclosed two Claude Code CVEs — CVE-2025-59536 (CVSS 8.7) and CVE-2026-21852 (CVSS 5.3) — showing repository-level config files act as execution layer: cloning and opening an untrusted project can trigger RCE and API key exfiltration before any consent dialog. Any agent running one of the four covered skill formats with the trifecta conditions is exposed.

flowchart LR
  A[Private data access] --> D{Lethal Trifecta}
  B[Untrusted content] --> D
  C[External egress] --> D
  D -->|all three| E[Exfiltration / RCE]
  S[Sandbox + egress restriction] -.cuts.-> E

What to do

The page's checklist, grouped:

• Registry/install: only install skills from verified publishers with code signing; enable automated scanning; review permissions; pin versions to block malicious auto-updates.
• Runtime: run agents in containers/sandbox; restrict network egress for agent processes; monitor filesystem and network activity; audit installed skills and dependencies.
• Governance: maintain a skill inventory; require approval workflows; enable audit logging; establish incident response for skill compromise.
• Development: cryptographically sign published skills; ship permission manifests; test in isolation before publishing.

Caveats

v1 is still in public review (comments go to a Google Doc, not GitHub). ClawHub has since added automated scanning and a VirusTotal partnership, but the page states the broader ecosystem "remains largely unprotected." The fetched text cuts off at Feb 5, so the incident timeline is partial.