OWASP Agentic Skills Top 10 — Complete Reference for Healthcare Security Teams

Learning Center

This is the complete reference companion to OWASP's Agentic Skills Top 10: The Three Risks Healthcare Teams Need to Understand Now. That post covers the two critical risks and one high-severity risk in depth. This document covers all ten, with full mitigations, real-world evidence, severity levels, and MAESTRO framework mapping for each.

What Are Agentic Skills?

Agentic AI skills are reusable, named behaviors that encode complete workflows for AI agents. Unlike MCP tools — which define what resources and actions are available — skills define how to use those tools in sequence to accomplish goals. They're written in natural language, YAML, JSON, or code, and distributed through registries analogous to npm, the Chrome Web Store, or mobile app stores.

Skills typically include task understanding and goal decomposition, multi-step planning and tool orchestration, file system and network access, safety guardrails and output formatting, and persistent memory and cross-session state. The same capabilities that make skills powerful make them a significant attack surface.

The OWASP framework uses a "Lethal Trifecta" concept from Snyk and Palo Alto Networks: a skill is especially dangerous when it simultaneously has access to private data (credentials, API keys, sensitive files), exposure to untrusted content (skill instructions, memory files, external URLs), and ability to communicate externally (network egress, webhook calls). Most production agent deployments today satisfy all three conditions.

The 2026 Incident Baseline

This framework is grounded in documented incidents, not theoretical risk. Key figures from the first half of 2026:

Of 3,984 skills scanned by Snyk's ToxicSkills audit, 36.82% contained security flaws, 13.4% contained critical-level issues, and 76 confirmed active malicious payloads were found. The ClawHavoc campaign produced 1,184 malicious skills across 12 publisher accounts. Over 135,000 AI agent instances were confirmed publicly internet-exposed with insecure defaults, of which more than 53,000 correlated with prior breach activity. Of 142,836 live skills scanned by Air Security, 17,822 — covering 6.7 million installs — rested on at least one untrusted external instruction source.

The Ten Risks

AST01 — Malicious Skills | Critical

Malicious skills are fully functional agent behaviors that carry hidden payloads — credential stealers, backdoors, data exfiltration routines, or persistent memory poisoning. They enter environments through the same installation process as legitimate skills.

Real-world evidence: The ClawHavoc campaign (January–February 2026) flooded the primary agent skill registry with 1,184 malicious skills. Five of the top seven most-downloaded skills at peak infection were confirmed malware, targeting exchange API keys, wallet credentials, SSH keys, browser passwords, environment files, and agent identity files. The Paperclip impersonation campaign (July 2026) used a lookalike domain to distribute Trojanized skills that reached over 300,000 installs each before detection — automated Python package scanners flagged the attack within hours, but the skills escaped detection entirely.

Key mitigations: Implement Merkle root signing at the registry level. Require code signing for all published skills. Enable automated behavioral scanning at install time (not just pattern matching — see AST08). Maintain an allowlist of approved skills for production agent deployments. Treat skill installation as equivalent to software installation from a governance perspective.

MAESTRO layers: 7 (Agent Ecosystem), 3 (Agent Frameworks), 6 (Security & Compliance), 4 (Deployment & Infrastructure), 5 (Evaluation & Observability)

AST02 — Supply Chain Compromise | Critical

Skills depend on external resources — GitHub repositories, npm packages, documentation URLs, MCP servers — that can be compromised, hijacked, or replaced without the skill file itself changing. Supply chain compromise introduces malicious behavior through a skill's dependencies rather than its own code.

Real-world evidence: Air Security's SkillJacking research (July 2, 2026) found 925 skills serving approximately 134,000 agents resting on instantly hijackable dependencies: deleted GitHub accounts, unregistered packages, expired domains, freed cloud application slots. Researchers took over the most popular video-generation skill on a major registry simply by re-registering the deleted owner account. CVE-2025-59536 (CVSS 8.7) and CVE-2026-21852 (CVSS 5.3) in Claude Code demonstrated that repository-controlled configuration files could execute arbitrary shell commands and exfiltrate API keys at project open time, before any user consent dialog.

Key mitigations: Implement registry transparency logs. Pin all skill dependencies to immutable hashes — never version ranges. Track provenance for all installed skills. Monitor dependency ownership continuously — a dependency that changes hands is a supply chain event. Apply the Universal Skill Format's `content_hash` field to detect any post-install modification.

MAESTRO layers: 7, 3, 6, 4

AST03 — Over-Privileged Skills | High

Skills routinely request broader permissions than their stated function requires. A skill that summarizes documents may request access to the entire file system. A skill that sends notifications may request access to all agent credentials. Over-privileged skills expand blast radius when compromised and create unnecessary exposure to sensitive data.

Real-world evidence: Snyk's "280+ Leaky Skills" report (February 5, 2026) documented credential exposure at scale — over 280 skills found exposing API keys and PII through over-permissioned access. Skills declaring `network: true` (binary network access) rather than specific domain allowlists were a primary finding.

Key mitigations: Enforce least-privilege permission manifests. Validate skills against a declared permission schema before execution. Require explicit justification for broad file system or network access. Use the Universal Skill Format's `permissions` block with path-level declarations and domain allowlists rather than boolean flags. For healthcare: apply minimum necessary access principles to agent skills the same way you apply them to user accounts.

MAESTRO layers: 6, 4, 3, 7

AST04 — Insecure Metadata | High

Skill metadata — the YAML frontmatter, JSON manifest, or configuration headers that describe a skill — can itself be a payload delivery mechanism. Malicious content embedded in metadata fields can trigger unsafe YAML deserialization, impersonate legitimate publishers, or smuggle instructions past security review through fields that appear benign.

Real-world evidence: Snyk documented a fake "Google Skill" on the primary registry (February 10, 2026) that used typosquatting and brand impersonation through its metadata fields to appear legitimate. Skills delivering payloads through YAML frontmatter — exploiting unsafe deserializers that execute arbitrary code during parsing — were documented in the ToxicSkills audit.

Key mitigations: Use safe YAML/JSON loaders with dangerous tag execution disabled. Validate all skill metadata against a schema before loading. Implement publisher identity verification at the registry level. Apply static analysis to metadata fields, not just skill body content. The Universal Skill Format's `author.identity` field using decentralized identity anchors addresses the impersonation vector.

MAESTRO layers: 7, 3, 4, 6

AST05 — Untrusted External Instructions | High

Skills frequently reference external sources — websites, documentation URLs, GitHub files, MCP servers — from which they pull instructions at runtime. If those sources are compromised, changed, or attacker-controlled, the agent executes attacker-controlled instructions without any indication that the skill's behavior has changed. The skill file itself remains clean.

Real-world evidence: Air Security's "Story of Skills" research (June 22, 2026) demonstrated that a researcher-built malicious skill reached 26,000 agents through a trusted marketplace while every scanner cleared it — the malicious payload was served from an external documentation URL referenced by an otherwise clean skill. A follow-on scan of 142,836 live skills found 17,822 (12.4%, 6.7 million installs) resting on at least one untrusted external instruction source.

Key mitigations: Maintain an inventory of all external sources referenced by installed skills. Implement content pinning — hash external instruction sources and alert on changes. Continuously rescan skills for new external dependencies introduced through updates. Treat any external URL in a skill as a potential instruction injection point. Network restrictions for agent processes (AST06) limit the blast radius when external sources are compromised.

MAESTRO layers: 3, 2, 7, 6

AST06 — Weak Isolation | High

Skills that execute without container or sandbox isolation run with the same permissions as the host process. A skill with shell access in a weakly isolated environment can read credentials from disk, modify system files, install persistence mechanisms, or pivot to other systems on the network. Isolation is the control that limits blast radius when any other control fails.

Real-world evidence: SecurityScorecard (February 2026) confirmed 135,000+ AI agent instances publicly internet-exposed with insecure defaults, with over 53,000 correlated with prior breach data. Microsoft Defender Security Research Team issued an advisory stating that OpenClaw-class agents with default host-mode execution "should be treated as untrusted code execution with persistent credentials" and are not appropriate for standard workstations.

Key mitigations: Make container or Docker sandbox isolation the default for skill execution. Make host-mode execution an explicit opt-in with documented justification. Implement network restrictions for agent processes — skills should not have unrestricted egress. Monitor agent file system and network activity at the host level. For healthcare: agent processes with access to clinical data should run in isolated environments with explicit network controls, consistent with how you'd treat any application handling PHI.

MAESTRO layers: 4, 6, 3

AST07 — Update Drift | Medium

Skills that are not pinned to specific versions automatically receive updates from their publishers. A skill that was safe at installation may receive a malicious update — either through a compromised publisher account or through a legitimate publisher whose dependency chain has been compromised. Update drift means the security posture of an installed skill can change without any action by the deploying organization.

Real-world evidence: CVE-2026-28363 (CVSS 9.9, "ClawJacked") disclosed by Oasis Security (February 26, 2026) demonstrated that update delivery mechanisms could be abused to push malicious payloads to existing installations. The ClawHavoc campaign's use of 12 compromised publisher accounts showed how update trust can be weaponized at scale.

Key mitigations: Pin skill versions to specific releases. Implement hash verification for skill packages at install and update time. Treat skill updates as new installations requiring the same review process. Subscribe to security advisories for skill registries and platforms. Implement an approval workflow for skill updates in production environments.

MAESTRO layers: 4, 6, 7

AST08 — Poor Scanning | Medium

Pattern-matching security scanners — the primary defense at most registries — are systematically ineffective against the majority of malicious skills. Skills that embed malicious behavior in natural-language instructions, reference external payloads, hide content in binary or archive formats, or pad payloads to force scanner truncation all bypass pattern matching reliably.

Real-world evidence: Trail of Bits (June 3, 2026) tested every major public skill scanner — registry-level scanners, Cisco's skill-scanner, and third-party tools — and bypassed all of them in under an hour using documented evasion techniques. Snyk's "Why Your Skill Scanner Is Just False Security" (February 11, 2026) documented that pattern-matching scanners miss the majority of critical threats, which rely on natural-language instruction manipulation rather than code signatures. Air Security's "Circus of Skills" researcher-built skill bypassed all scanners while reaching 26,000 agents.

Key mitigations: Implement semantic and behavioral analysis alongside pattern matching. Use multi-tool scanning pipelines — no single scanner is sufficient. Test scanners against known evasion techniques before deploying them as a control. Treat scanner results as one signal among many, not a binary pass/fail gate. The Universal Skill Format's `scan_status` field creates a machine-readable provenance trail that enables multi-scanner aggregation.

MAESTRO layers: 5, 6, 3

AST09 — No Governance | Medium

Most organizations deploying agentic AI have no comprehensive inventory of what agents are running, what skills those agents are using, or what permissions those skills have claimed. Without that inventory, organizations cannot respond to malicious skill disclosures, cannot audit agent actions, and cannot enforce policy.

Real-world evidence: SecurityScorecard confirmed 53,000+ exposed instances with no SOC visibility. Bitdefender telemetry (February 2026) confirmed employees deploying AI agents on corporate devices with no security team awareness. Microsoft's Omar Turner, speaking on the OWASP project, noted that most CISOs cannot honestly answer how many agents are running or how many skills are embedded within those agents — and therefore could not respond to a malicious skill incident at scale.

Key mitigations: Build and maintain a skill inventory across all agent deployments. Implement an approval workflow for skill installations — treat it as a software governance process. Enable comprehensive audit logging for agent actions: file access, shell commands, network calls, memory writes. Establish agentic identity controls so individual agent workloads can be tracked and attributed. Develop an incident response runbook for malicious skill scenarios before you need it. For healthcare: integrate skill governance into your existing AI governance program and HIPAA security rule compliance processes.

MAESTRO layers: 6, 7, 5

AST10 — Cross-Platform Reuse | Medium

Skills designed for one platform are frequently ported to others without security review. Platform-specific security properties — permission scoping, sandbox behavior, identity controls — don't transfer when a skill is converted to a new format. A skill that was reasonably safe on one platform may be unsafe when converted and deployed on another.

Real-world evidence: Malicious skills from the ClawHavoc campaign were confirmed ported across multiple registries and platforms. Air Security's research documented skills serving agents across incompatible platform ecosystems, with security metadata lost in translation.

Key mitigations: Treat cross-platform skill ports as new installations requiring full security review. Use the Universal Skill Format as a common baseline — its security metadata is designed to be platform-agnostic. Implement format validation that checks for security metadata completeness after any conversion. Registry operators should implement provenance tracking that flags converted skills for additional scrutiny. The OWASP metadata loss simulator tool allows comparison of two skill manifests to see which security metadata is lost or weakened after a cross-platform port.

MAESTRO layers: 7, 3, 6

The Universal Skill Format: Security Design Rationale

The Universal Agentic Skill Format v1.0 is OWASP's proposed cross-platform standard. It's designed as a YAML superset of all current platform-specific formats. Key security design decisions:

Path-level permission declarations replace boolean flags. Instead of `files: read: true`, a skill declares explicit paths. Network access uses a domain allowlist rather than `network: true`. This closes the over-permission gap (AST03) and makes permission scope machine-readable for automated governance.

Identity file protection by default. The `deny_write` list includes agent memory, soul, and configuration files. Skills must explicitly override this to write to identity files — preventing the persistent backdooring pattern documented in ClawHavoc (AST01) and ClawJacked (AST07).

Cryptographic provenance. The `signature` field (ed25519) and `content_hash` field (SHA-256) together enable Merkle-root registry verification — the same model used in modern software package registries. A modified skill is detectable without re-downloading it from source (AST01, AST02).

Machine-readable governance signals. The `risk_tier` field (L0 through L3) enables automated policy enforcement without per-skill manual review. The `scan_status` field creates an auditable provenance trail across multiple scanning tools (AST08, AST09).

Dependency declaration. The `requires` block with explicit binary and runtime version dependencies enables dependency tracking and update drift detection (AST07).

MAESTRO Framework Mapping

The Cloud Security Alliance MAESTRO framework provides a 7-layer threat model for agentic AI systems. All ten AST10 risks map to specific MAESTRO layers, enabling targeted threat localization:

Layer 7 (Agent Ecosystem) is implicated in 9 of the 10 risks — it's the primary entry point for malicious skills, supply chain compromise, and cross-platform reuse. Layer 6 (Security & Compliance) appears in all 10 — governance and monitoring gaps are universal. Layer 3 (Agent Frameworks) appears in 8 — the framework execution layer is where skill permissions are enforced (or not). Layers 4 and 5 (Deployment & Infrastructure; Evaluation & Observability) are particularly relevant to isolation (AST06) and scanning (AST08) respectively.

For healthcare organizations building threat models against MAESTRO: Layers 6 and 7 are where your skill governance program lives. Layer 4 is where isolation controls and network segmentation for agent workloads belong. Layer 5 is where audit logging and behavioral monitoring fit.

Getting Started: Healthcare Security Team Checklist

The OWASP project includes a full security checklist. The healthcare-specific prioritization:

Immediate (this quarter):

Conduct a skill inventory — enumerate all agents running in your environment and what skills each uses
Review installed skills against the AST01 and AST02 risk criteria — are any installed from unverified publishers? Do any have open dependency chains?
Verify that agents handling PHI or clinical credentials run in isolated environments (AST06)
Check that audit logging captures agent actions at sufficient granularity to support incident response (AST09)

Near-term (next two quarters):

Implement an approval workflow for skill installations in production environments
Establish version pinning and hash verification for all installed skills
Implement external instruction source monitoring for skills that reference external URLs (AST05)
Develop a malicious skill incident response runbook — including how you'd identify affected agents and block a skill at scale

Strategic:

Integrate skill governance into your AI governance program and HIPAA security rule compliance processes
Adopt Universal Skill Format evaluation criteria for skill procurement and review
Subscribe to registry security advisories and establish a process for acting on them
Build agentic identity controls so individual workloads can be tracked, audited, and revoked