AI 安全與標準
OWASP Agentic Skills Top 10 Completes Public Review for v1, Treating the Skill Supply Chain as a Distinct Attack Surface
The public review of the OWASP Agentic Skills Top 10 v1 draft has concluded. The framework organizes malicious skills, excessive permissions, dependency confusion, and cross-platform portability risks into ten control categories. It treats skills as the behavioral layer between models and MCP tools and proposes a universal format for declaring permissions, provenance, and integrity.
The public comment period for the OWASP Agentic Skills Top 10 (AST10) v1 draft ended on July 31. The project aims to fill gaps between existing security checklists for LLMs, agents, and MCP. Rather than focusing on individual prompt-injection attacks or the protocol itself, it addresses “skills” that agents load, retain over time, and connect to file systems, shells, networks, and external tools. Covered formats include SKILL.md files with YAML frontmatter, Claude Code skills, Cursor and Codex manifests, and VS Code extensions.
The draft divides the risks into AST01 through AST10, covering malicious skills, compromised supply chains and dependencies, inadequate permission declarations, secret leakage, insufficient isolation, and the loss of security semantics caused by cross-platform reuse. Its engineering value lies in treating skill installation as package installation combined with workflow authorization. In addition to scanning scripts, teams should verify provenance, versions, and hashes; enforce least privilege; restrict network egress; and log skill activation, tool calls, and access to sensitive resources. The project also proposes a Universal Skill Format that uses YAML to standardize skill identity, permissions, dependencies, integrity, and execution constraints, enabling different agent platforms to apply similar CI checks.
This is not yet a finalized industry standard. The OWASP project page lists it as a new project under active development, and the universal format remains only a proposal; platforms currently lack a shared enforcement mechanism. The vulnerability rates and counts of malicious skills cited by the repository come from multiple external studies whose sampling methods and definitions of “security flaw” are not directly comparable. For now, platform teams can use AST10 as a threat-modeling and procurement checklist, establishing signing, permission-diffing, sandboxing, and revocation processes for skills. The next questions are whether the finalized v1 will stabilize the category names and whether major skill registries will implement machine-verifiable manifests.