OWASP Publishes Agentic Skills Top 10: First Security Framework for AI Agent Skill Supply Chain

OWASP Foundation·high signal

OWASP released the Agentic Skills Top 10 (AST10), the first comprehensive security framework for AI agent skills — the reusable behavioral workflows that define how agents sequence tool use. The project documents real-world attacks including the ClawHub registry poisoning where 5 of the top 7 most-downloaded skills were confirmed malware. Skills represent a unique attack surface distinct from both model-level and protocol-level security because they encode complete behavioral sequences rather than individual tool calls.