OWASP's Agentic Skills Top 10: The Three Risks Healthcare Teams Need to Understand Now

AI Security

OWASP published the final v1.0 of its Agentic Skills Top 10 on August 21, 2026 — the first dedicated security framework for the behavior layer of AI agent systems. It arrives backed by a documented crisis: a wave of real-world incidents in early 2026 in which malicious skills hit registries at scale, automated scanners failed to catch them, and agents across tens of thousands of deployments were compromised before anyone noticed.

This post focuses on the three risks that account for most of that documented harm, and on OWASP's proposed Universal Skill Format as the structural response. A companion Learning Center reference covers all ten risks in full.

What the Framework Is Actually Talking About

The mental model OWASP offers is useful: MCP defines how a model talks to tools. Skills define what those tools actually do. Skills are the behavioral abstraction layer — named, reusable workflows that encode multi-step task execution, tool orchestration, file and network access, and persistent state. They're written in natural language, YAML, JSON, or code, and they're distributed through registries the same way npm packages or browser extensions are distributed.

The attack surface that creates is directly analogous to package registries and browser extension stores — both of which have a long history of supply chain compromise, typosquatting, and malicious payload delivery. Skills bring that same supply chain risk into the agent layer, with one additional wrinkle: because skills can contain natural-language instructions that agents execute autonomously, malicious behavior can be encoded in plain text that pattern-matching scanners don't flag.

AST01 — Malicious Skills

The top risk on the list is confirmed, not theoretical. In January 2026, the ClawHavoc campaign flooded the primary AI agent skill registry with 341 malicious skills over three days. By the time the campaign was analyzed, 1,184 malicious skills had been published across 12 publisher accounts. Five of the top seven most-downloaded skills at peak infection were confirmed malware. Target data included exchange API keys, wallet credentials, SSH keys, browser passwords, and environment files. Several skills also wrote malicious instructions directly into agent memory and identity files — creating session-persistent backdoors that survived skill removal.

The Snyk ToxicSkills audit, published February 5, 2026, scanned 3,984 skills across registries and found 36% contained security flaws, 13.4% contained critical-level issues, and 76 confirmed active malicious payloads — 8 of which were still live at time of publication.

The healthcare implication is direct. Agent skills operating in healthcare environments that have access to clinical data, EHR APIs, or internal documentation are exactly the kind of high-value target that malicious skill authors look for. A skill that exfiltrates the API credentials an agent uses to query clinical systems doesn't need to breach your perimeter — it rides in through the agent's own skill installation process.

OWASP's mitigations for AST01 center on Merkle root signing and registry scanning. The practical near-term equivalent for healthcare organizations: treat skill installation with the same approval process as software installation. No skill should be installed in an agent operating on clinical or sensitive data without a review process. "Install from the registry" is not a security control.

AST02 — Supply Chain Compromise

Supply chain compromise is the second critical risk, and it's where the parallel to traditional software supply chain attacks is sharpest. Skills hosted on GitHub and other repositories can pull typosquatted dependencies, reference deleted accounts, or load instructions from attacker-controlled external URLs — any of which can introduce malicious behavior without the skill itself containing obvious malicious code.

Check Point Research disclosed two Claude Code vulnerabilities in February 2026 — CVE-2025-59536 (CVSS 8.7) and CVE-2026-21852 (CVSS 5.3) — that illustrate the supply chain risk at the configuration file level. Repository-controlled configuration files were found to execute arbitrary shell commands and exfiltrate API keys at project open time, before any user consent dialog appeared. Simply cloning and opening an untrusted repository was sufficient to trigger the payload. The skill didn't need to be explicitly installed.

Air Security's SkillJacking research (July 2, 2026) extended this further: 925 skills serving approximately 134,000 agents were found to rest on instantly hijackable dependencies — deleted GitHub accounts, unregistered packages, expired domains, freed cloud application slots. Researchers took over the most popular video-generation skill on a major registry by re-registering the deleted owner account. Every agent using that skill then executed under attacker control.

For healthcare, this risk intersects directly with the vendor risk management problem. Healthcare organizations frequently evaluate the security of a tool at point of procurement and then treat it as trusted indefinitely. A skill that was safe at installation is not necessarily safe six months later if its upstream dependencies have changed hands or its external instruction sources have been compromised. Ongoing monitoring of installed skills is not a standard practice in most healthcare environments — but it needs to become one.

AST05 — Untrusted External Instructions

The fifth risk on the list — ranked high severity — is the mechanism that made the ClawHavoc campaign and the Air Security proof-of-concept so effective. Skills frequently pull instructions from external sources: websites, documentation URLs, MCP servers, GitHub files. When those external sources change — or are controlled by an attacker — the agent executing the skill receives attacker-controlled instructions without any indication that anything has changed.

Air Security demonstrated this in June 2026: a researcher-built malicious skill reached over 26,000 agents through a trusted marketplace and social media while every scanner cleared it. The malicious payload was served from an attacker-controlled external documentation URL that the skill referenced. The skill itself was clean. The instructions it fetched were not.

A follow-on scan of 142,836 live skills found that 17,822 — accounting for 6.7 million installs — rested on at least one untrusted external instruction source. These skills behave differently depending on what their external sources say, and neither the user nor the agent has visibility into when those sources change.

In healthcare, the risk compounds with the agentic workload model. An agent that queries external sources as part of its workflow — pulling clinical guidelines, checking policy documents, referencing regulatory texts — is doing something that looks identical to an agent that's been compromised to pull instructions from an attacker's server. The behavior is indistinguishable at the API level. Detection requires source inventory and content monitoring, not just runtime behavioral analysis.

The Universal Skill Format

Running across all ten risks is a structural problem: skill files lack a standardized format that carries enough security metadata for automated tools to reason about them. OWASP's proposed Universal Agentic Skill Format v1.0 is the framework-level response.

The format is a YAML specification designed as a superset of all current platform-specific skill formats. Its security-relevant design decisions are worth understanding:

The `permissions` block uses explicit path-level declarations and a domain allowlist for network access — not boolean on/off flags. A skill can declare exactly which files it reads and writes, which network domains it may contact, and whether it has shell access. The format includes an explicit `deny_write` list for agent identity files (memory, soul, and agent configuration files) — skills must explicitly override this to write to those files, preventing the persistent backdooring pattern used in ClawHavoc.

The `signature` and `content_hash` fields together enable Merkle-root verification at the registry level — the same cryptographic provenance model that modern package registries use for supply chain integrity. A `scan_status` field creates a machine-readable provenance trail. A `risk_tier` field (L0 through L3) enables automated governance policy without per-skill manual review.

The format doesn't solve the problem on its own — adoption requires registry operators, platform developers, and skill authors to implement it. But it defines the security baseline that currently doesn't exist, and it gives security teams something concrete to evaluate against when assessing skills in their environments.

What Healthcare Security Teams Should Do Now

The OWASP list is structured around three audiences: security teams, skill developers, and platform developers. The security team guidance is the most immediately actionable for healthcare:

Conduct a skill inventory. Most healthcare organizations deploying agentic AI have no comprehensive view of what skills are installed across their agent deployments. That inventory is the prerequisite for everything else — you can't respond to a malicious skill disclosure if you don't know whether the skill is in use.

Implement an approval workflow. Skills operating in environments with access to clinical data, credentials, or internal systems should require the same approval process as any software installation. The registry model — install anything from the marketplace — is not compatible with healthcare security requirements.

Monitor installed skills continuously. Skills that were safe at installation can become unsafe through dependency hijacking, domain expiration, or external instruction source compromise. Point-in-time review is insufficient. The Air Security SkillJacking research shows that the attack window for dependency hijacking opens silently and can affect hundreds of thousands of agents before anyone notices.

Build agentic identity controls. The AST09 risk (No Governance) specifically calls out the gap most CISOs face: they can't honestly say how many agents are running or what skills those agents are using. The MCP roadmap's agent identity work (covered in our prior post) is the long-term solution. The near-term equivalent is a skill inventory paired with agentic identity logging — knowing which agent invoked which skill, when, with what permissions.

The question Microsoft's Omar Turner posed to Dark Reading is the right one to put to your own organization: if a source published a malicious skill disclosure today, how quickly could you determine whether that skill is in use across your environment and block it at scale? If the answer isn't measured in minutes, the governance gap is real.

The companion Learning Center post covers all ten AST10 risks in full with mitigations, real-world evidence, and MAESTRO framework mapping: OWASP Agentic Skills Top 10 — Complete Reference for Healthcare Security Teams.