OWASP Agentic Skills Top 10: Supply Chain Risks & Hardening Guide

OWASP Agentic Skills Top 10 Key Information Summary Vulnerability Overview Nature of the issue: The skill layer is a "lock-free" dependency issue. Skills exist as files, can read external documentation, consume prompts, and execute, but lack the signing, sandboxing, and pinning mechanisms found in package ecosystems. Core risk: OWASP classifies this type of risk as AST05, which is a "cousin" of LLM application risks (from the 2025 OWASP Top 10 for LLM applications). Supporting data: - A USENIX Security 2026 study analyzed 98,380 skills and confirmed that 157 malicious skills carry 632 vulnerabilities. - In January 2026, a single campaign pushed 1,184 malicious skills originating from 12 publisher accounts. - Over 135,000 internet-accessible agent instances were discovered by Cisco in February, but only 29% of organizations plan to deploy agentic capabilities, and only 29% feel prepared for security. Scope of Impact Risk categories (9 out of 10 risk categories are supply chain issues): Scanner limitations: - Scanners truncate files and miss entire files; LLM judges may misclassify malicious configurations as benign. - Automated scanning cannot replace supply chain judgment. NVIDIA's built-in skill scanner missed most threats in approximately 1/4 of the skills. - The checker cannot be both the model and its host (the auditor cannot be the author). Remediation Core principle: The repository is the control point. Skills arrive as files, metadata is in YAML frontmatter, dependencies are declared in and , and configuration files are read in . Enterprises already have version control, approval, pinning, and audit trails, so no new control plane is needed. Five things worth doing this quarter: 1. Establish strict inventory: Track names, versions, content hashes, installer identity, and last scan status. 2. Pin content hashes: Use hashes rather than version ranges, and apply to the entire transitive tree. 3. Protect agent identity and memory files: Treat these paths as protected persistence mechanisms, as writes will persist after uninstallation. 4. Snapshot external references: Allow hashing and record the resolved digest, snapshotting external references to reviewed artifacts on each load or snapshot, preventing execution of tampered content. 5. Continuously re-verify: Snapshots are snapshots of mutable state; install-time gating misses memory poisoning, drift, and tampered references. Mend.io's positioning: Provides dependency resolution across 200+ languages, malicious package detection, version pinning, and automated update governance. Maintains an inventory of AI components via AI-BOM, enabling continuous testing for AI security risk assessment. The skill layer is a simple LLM artifact type; the infrastructure is already in place. The industry should not rely on new OWASP skill scanners (cheap, easy to bypass, easy to weaponize); instead, it should leverage the package ecosystem's existing signature provenance, immutable pinning, real inventory, and independent verification. POC / Exploit Code The page does not include POC code or exploit code blocks. References OWASP Agentic Skills Top 10 v1.0 Publisher and project repositories

Goal Reached Thanks to every supporter — we hit 100%!

OWASP Agentic Skills Top 10: Supply Chain Risks & Hardening Guide