OWASP Agentic Skills Top 10
Scope
The OWASP Agentic Skills Top 10 (AST10) ranks ten risks on the agent skill: the packaged instruction-and-script artifact an agent loads and runs, distinct from the model that reasons and the tool the skill calls over MCP. The project states the boundary directly: “MCP = how the model talks to tools; AST10 = what those tools actually do.”1 It places the skill as a behavior layer between the model and the MCP tool layer.1
Structure
| ID | Name | Severity |
|---|---|---|
| AST01 | Malicious Skills | Critical |
| AST02 | Supply Chain Compromise | Critical |
| AST03 | Over-Privileged Skills | High |
| AST04 | Insecure Metadata | High |
| AST05 | Untrusted External Instructions | High |
| AST06 | Weak Isolation | High |
| AST07 | Update Drift | Medium |
| AST08 | Poor Scanning | Medium |
| AST09 | No Governance | Medium |
| AST10 | Cross-Platform Reuse | Medium |
The ten names and severities above are computed from the GenAI Crosswalk’s entry inventory.2
Leadership
The project page names Ken Huang as project lead and Fabio Cerullo as project co-leader.1 Huang is also named on the OWASP AIVSS leadership team; see Ken Huang.
Mapping to CSA MAESTRO
The project states that each AST10 risk is mapped to CSA MAESTRO’s seven layers.1 The GenAI Crosswalk corroborates the target framework: all 36 AST mappings recorded in that dataset target CSA MAESTRO and no other framework.2 It does not corroborate a one-layer assignment per risk — its AST rows carry three to five MAESTRO control ids per entry.2
Maturity
This is a registered list with a published risk set and an unreviewed mapping layer. All 36 mappings against MAESTRO carry the note “DRAFT — SME review required.”2 The crosswalk’s classifier, which proposes candidate mappings for every other source list in the dataset, has produced no predictions for AST10 at all.2 The crosswalk’s own README records the list’s framework coverage as “registered; mappings pending.”2
The wiki carries no dated standards review of this list, and the Standards Review Backlog records that as deliberate rather than outstanding: no wiki gap claim, maturity rung or reference-architecture control currently rests on an AST code.
See Also
- MCP Security — the tool layer AST10 sits above.
- CSA MAESTRO — the only framework AST10 currently maps to, and only in draft.
- OWASP Agentic AI Top 10 — the agent-level sibling taxonomy; AST10 ranks the skill artifact rather than the agent.
- Supply Chain Security for Agents — AST02 and AST08 anchor its pre-install scanning layer.
- GenAI Crosswalk — the dataset carrying AST10’s only published mappings.
- Ken Huang — project lead.
- OWASP — publishing organization.
Notes
Sources
- OWASP Agentic Skills Top 10 (AST10) project page
- GenAI Crosswalk data layer and README (AST entry names, severities, MAESTRO mappings)
Footnotes
-
OWASP, Agentic Skills Top 10 (AST10) project page, retrieved 2026-09-16. States: “The OWASP Agentic Skills Top 10 (AST10) is the first comprehensive security framework for AI agent skills”; names project leads Ken Huang and Fabio Cerullo; states each AST10 risk maps to CSA MAESTRO’s seven layers. Not independently corroborated by a second source. ↩ ↩2 ↩3 ↩4
-
OWASP GenAI Security Project, GenAI Crosswalk, v4.0.0, data layer and README, captured 2026-09-16.
.raw/articles/owasp-genai-crosswalk-2026-09-16.md, Parts A and C. ↩ ↩2 ↩3 ↩4 ↩5 ↩6