OWASP Agentic Skills Top 10 (AST10)

What it is

OWASP Agentic Skills Top 10 (AST10), v1.0 (2026 Edition), led by Ken Huang. A framework for the "skill" layer that sits between the model (OWASP LLM Top 10) and the protocol (OWASP MCP Top 10) — where MCP defines what tools exist, skills define how agents chain them. The summary names the incidents and the Universal Skill Format; below are the CVE mechanisms, version boundaries, and concrete controls it omits.

How it works — the CVEs

• CVE-2025-59536 (CVSS 8.7) and CVE-2026-21852 (CVSS 5.3), Claude Code (Check Point, Feb 25): repository-controlled config files are part of the execution layer — cloning and opening an untrusted project triggers RCE and API-key exfiltration before any trust dialog appears.
• CVE-2026-28363 "ClawJacked" (CVSS 9.9), OpenClaw (Oasis, Feb 26): a malicious website brute-forces the localhost WebSocket (no rate limiting) to hijack a local instance, register new devices without prompts, and exfiltrate via existing integrations. Patched in 2026.2.25 within 24h.
• OpenClaw log poisoning patched in 2026.2.13: agents read their own logs, so WebSocket-injected log text becomes indirect prompt injection.
• ClawHavoc persistence: skills write into SOUL.md / MEMORY.md for session-persistent backdoors; Vidar variants target openclaw.json, device.json.

Preconditions — the "Lethal Trifecta"

The page (citing Willison / Palo Alto) states a skill is dangerous when three conditions meet; it says most production deployments satisfy all three.

flowchart TD
  A[Access to private data<br/>SSH keys, wallets, .env] --> D{All three?}
  B[Exposure to untrusted content<br/>skill/memory files, email] --> D
  C[External egress<br/>network, webhooks, curl] --> D
  D -->|yes| E[Exploitable skill]

What to do

Concrete controls the page states:

• Protect identity files: deny_write on SOUL.md, MEMORY.md, AGENTS.md by default; require explicit override.
• Network as a domain allowlist (network.allow), not network: true; deny: "*".
• Sign skills with ed25519 + content_hash; enable Merkle-root registry transparency logs.
• Pin dependencies to immutable hashes, never version ranges.
• Default to container/Docker sandbox; host mode opt-in only.
• Trust prompts before repo config executes (addresses the Claude Code CVEs).
• Microsoft Defender advisory: treat OpenClaw as "untrusted code execution with persistent credentials… not appropriate to run on a standard personal or enterprise workstation."

Caveats

Snyk's "False Security" finding: pattern-matching scanners miss most critical threats, which use natural-language instruction manipulation, not code signatures — behavioral scanning required. The project is still a New Project Proposal / active development; the Universal Skill Format is proposed, not ratified.