Top 10 Agentic Skills Risks from OWASP

OWASP (Open Worldwide Application Security Project) has published the top 10 threats associated with agentic skills in an effort to provide a shared framework for identifying and remediating risks within your organization.

According to OWASP, “agentic skills are becoming first-class citizens of AI workflow: reusable bundles of progressive instructions, code, resources, and operational know-how that agents can discover, load, and execute.” Such privileges make them both powerful and dangerous as they “move risk into a new layer where natural-language instructions, executable helpers, dependencies, metadata, registry trust, and runtime permissions all meet.”

Here’s the list, along with associated threat level and links to detailed descriptions:

1. Malicious Skills (Critical) — Skills that appear legitimate but contain hidden malicious payloads.
2. Supply Chain Compromise (Critical) — Registries without provenance allow attackers to mass upload, take over accounts, and poison distribution channels.
3. Over-Privileged Skills (High) — Skills are granted broader permissions than their stated function requires.
4. Insecure Metadata (High) — Unvalidated, unsigned metadata allows brand impersonation, understated permissions, and poisoned search.
5. Untrusted External Instructions (High) — Skills that point the agent at a URL or remote file to read at runtime trust mutable content that can be pulled into malicious instructions.
6. Weak Isolation (High) — Skills execute in the full security context as the host agent with no sandbox, creating a potential full-system compromise.
7. Update Drift (Medium) — Without immutable pinning and automated verification, deployed skills drift out of sync with known-good versions.
8. Poor Scanning (Medium) — Natural language blended with code defeats signature scanners so malicious skills pass automated checks.
9. No Governance (Medium) — Skills are installed by individual developers with no SOC visibility, no approval workflow, and no revocation mechanism,  creating a “shadow AI” layer that security teams cannot see or control.
10. Cross-Platform Reuse (Medium) — Porting skills across platforms (e.g., OpenClaw → Claude Code → Cursor → VS Code) without translating the security properties of the source format creates exploitable gaps.

OWASP also provides a practical assessment checklist for evaluating AI agent skills, which includes a series of checks along with example evidence to look for. 

Learn more at OWASP and read the full whitepaper for additional information: OWASP Agentic Skills Top 10 — Security risks and mitigations for agentic skill ecosystems.