owasp-agentic
Skill2 starsChanged 3 months agoMITView on GitHub
OWASP Agentic Security Top 10 (2026) vulnerability knowledge base for identifying, assessing, and remediating security risks in AI agent systems. Use during agentic threat models, agent security reviews, and MAF / Copilot / MCP security assessments. Triggers: "OWASP agentic", "ASI01"–"ASI10", "agentic threat model", "agent security review", "prompt injection review", "agent goal hijack", "tool misuse", "rogue agent", "memory poisoning", "inter-agent communication security", "agentic supply chain", "cascading agent failure", "human-agent trust", "MCP security assessment", "agent red team scenarios", "AIVSS scoring", "A2A protocol security", "agent card poisoning", "EchoLeak".
2 other projects use a version of this, 1 of them edited.
Adopted by
Most recently taken up by
- microsoft/hve-coreedited, first seen Oct 13, 2026
- ScaleDockHQ/scaledock-skillstheir own version, first seen Oct 2, 2026
Other versions2 projects use a version of this.
Word for word · 0
None found.
Edited · 1
- microsoft/hve-core★ 1.6k23% same
Wrote their own version · 1
- ScaleDockHQ/scaledock-skills★ 1same name
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository13 other files it gives its agents.
- agent-governance-toolkitSkill
- aks-cluster-architectureSkill
- azure-sre-agentSkill
- container-supply-chainSkill
- dependabot-configurationSkill
- drasiSkill
- hitl-design-patternsSkill
- identity-managed-identitySkill
- kedaSkill
- rust-patternsSkill
- tauri-desktop-ui-patternsSkill
- tauri-developmentSkill
- typespec-api-designSkill
The file
We split this skill into the rules it gives an agent
1 rule. About 0 are common, 1 is distinctive, and 0 are very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈1
Distinctive · estimate
This author's own choices. Worth a look.
0
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 130
Do not mark this engagement complete until:
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
OWASP Agentic Top 10 (2026)
Depth reference for the OWASP Top 10 for Agentic Applications (2026). Use this skill alongside the threat-modelling skill during AI / agentic reviews to go from prompt-map coverage to full per-vulnerability treatment: attack scenarios, vulnerability checklists, prevention controls, detection signals, and remediation steps.
Each per-vulnerability file includes a 2026 Threat Landscape section reflecting the post-publication evidence base - AIVSS v0.8, the MCP CVE wave, A2A protocol GA, Agent Card Poisoning, EchoLeak, and EU AI Act enforcement timing.
External guidance watch (July–August 2026)
- "Rethinking security for the age of AI" (Microsoft Security Blog, 2026-07-28) — Project Perception and a proposed "Cyber Stack" approach: threat models, telemetry, detection, and response must account for continuous, adaptive AI and autonomous systems. Treat the AI/agent platform itself as an evolving attack surface, not a fixed component.
- EXTRA — External Red Team Alliance (2026-07-28) — Microsoft's global AI red-teaming initiative. Follow EXTRA outputs and fold regular red-team testing into agent development and deployment pipelines (see also
microsoft-foundry/red-team). - "Securing AI Agents at Runtime" (Tech Community, 2026-07-30) — real-time protection and threat detection for Microsoft Agent 365 workloads. Treat agent runtime telemetry as a detection surface, not just an audit log.
- Black Hat USA 2026 coding-agent CI attacks (2026-08-05–07) — Novee Security disclosures showed an unprivileged GitHub issue could reach CI workflow secrets through command-validation gaps in Claude Code, Gemini CLI, OpenAI Codex, and GitHub Copilot Agent chains (CSA research note, August 7, 2026). Use as ASI01/ASI05 scenario grounding wherever agents touch CI pipelines.
- Azure DevOps MCP hidden PR-instruction injection (~2026-08-20) — malicious instructions invisible to human reviewers embedded in pull-request comments but readable by MCP-connected agents. Use as an ASI01/ASI06 example of review-surface bypass.
- OWASP GenAI new publications (August 2026) — "A Practical Guide for Secure MCP Server Development" and "CheatSheet: A Practical Guide for Securely Using Third-Party MCP Servers 1.0": control baselines to cite when planning ASI02/ASI04 remediation.
Use When
| Should trigger | Should NOT trigger | Nearby skill collision |
| User asks for detailed treatment of ASI01-ASI10 risks, agent-specific attack scenarios, prevention controls, detection signals, or remediation guidance for an agentic system. | User only needs a broad architecture threat model, a general secure-design review, or non-agent security guidance with no ASI category depth required. | Use threat-modelling first when you need system-wide boundary mapping and risk identification; use this skill once a specific OWASP Agentic risk needs full treatment. |
When to Load
Load this skill when:
- A threat model identifies one or more ASI risks that need detailed treatment
- A security review targets an MAF, Copilot, MCP, or agentic system
- A developer needs concrete prevention controls or detection guidance for a specific agentic vulnerability
- Post-incident remediation requires structured fix steps for an ASI category
The threat-modelling skill's ai-agentic-threat-catalogue.md provides the prompt map (which risks apply). This skill provides the depth for each risk that applies.
Vulnerability Index
| ID | Title | Category |
| ASI01:2026 | Agent Goal Hijack | Goal Integrity |
| ASI02:2026 | Tool Misuse and Exploitation | Tool Security |
| ASI03:2026 | Identity and Privilege Abuse | Access Control |
| ASI04:2026 | Agentic Supply Chain Vulnerabilities | Supply Chain |
| ASI05:2026 | Unexpected Code Execution | Execution Safety |
| ASI06:2026 | Memory and Context Poisoning | Data Integrity |
| ASI07:2026 | Insecure Inter-Agent Communication | Communication Security |
| ASI08:2026 | Cascading Failures | Resilience |
| ASI09:2026 | Human-Agent Trust Exploitation | Human Factors |
| ASI10:2026 | Rogue Agents | Behavioral Integrity |
Real-world scenario citations (July 2026)
- ASI03 (Identity and Privilege Abuse) and ASI09 (Human-Agent Trust Exploitation): See the canonical writeup in sibling
agent-governance-toolkitskill → "Microsoft least-privilege guidance (July 2026)" section, citing "Least privilege for AI agents: Identity, access, and tool binding" (Microsoft Security blog, July 16, 2026). The canonical scenarios (per-agent managed identity, scoped RBAC, tool-binding constraints, time-boxed elevation, separation of agent identity from provisioner) live there; this skill consumes them as the source of truth for ASI03 and ASI09 reference entries. Do not duplicate the scenarios inline, link. - ASI04 (Agentic Supply Chain Vulnerabilities): Microsoft Security blog, "explaining the AsyncAPI npm supply chain compromise" (July 15, 2026). GitHub Actions pwn request → import-time payload delivery via AsyncAPI npm package. Real-world example of build-time integrity failures that can poison agent dependencies.
- Forward-looking: Microsoft at Black Hat USA 2026 preview, future-of-defense, npm supply-chain intelligence, AI-era trust themes.
Reference Files
Load only the vulnerabilities relevant to the system under review. Start with the index, then load specific vulnerability files as needed.
| File | Vulnerability |
references/00-vulnerability-index.md | Full index with category groupings and cross-references |
references/01-agent-goal-hijack.md | ASI01 - goal hijack via prompt injection, deceptive tools, forged messages |
references/02-tool-misuse-and-exploitation.md | ASI02 - unsafe tool parameters, unauthorized tool sequences, schema bypass |
references/03-identity-and-privilege-abuse.md | ASI03 - over-privileged agents, credential misuse, identity delegation |
references/04-agentic-supply-chain-vulnerabilities.md | ASI04 - poisoned models, plugins, MCP servers, skills, packages |
references/05-unexpected-code-execution.md | ASI05 - shell execution, deserialisation, sandbox escape |
references/06-memory-and-context-poisoning.md | ASI06 - poisoned vector stores, RAG corruption, persistent context manipulation |
references/07-insecure-inter-agent-communication.md | ASI07 - agent spoofing, unsigned messages, protocol boundary bypass |
references/08-cascading-failures.md | ASI08 - error propagation, blast-radius amplification, circuit breaker absence |
references/09-human-agent-trust-exploitation.md | ASI09 - polished output tricking approvals, explainability gaps |
references/10-rogue-agents.md | ASI10 - scope self-modification, control evasion, concealed actions |
Each Reference File Contains
- Description - what the vulnerability is and how it manifests
- Risk - potential impacts with realistic consequences
- Vulnerability checklist - specific conditions that indicate the vulnerability is present
- Prevention controls - numbered, practical steps
- Example attack scenarios - named, realistic narratives
- 2026 Threat Landscape - post-publication evidence base (CVEs, frameworks, incidents) for the year
- Detection guidance - observable signals and monitoring patterns
- Remediation - concrete fix steps post-detection
Relationship to Other Skills
| Skill | Relationship |
threat-modelling | Provides the prompt map (ai-agentic-threat-catalogue.md); this skill provides depth per identified ASI |
secure-by-design | Complementary design-phase principles; this skill is assessment and remediation |
api-security-review | Covers OWASP API Top 10 and tool-facing API surface; load alongside for API-fronted agents |
agenteval | Red-team evaluation; use owasp-agentic findings as red-team test scenarios |
microsoft-agent-framework | Primary MAF runtime; ASI01 / ASI03 / ASI06 are the highest-relevance risks for MAF systems |
agent-governance-toolkit | Runtime policy enforcement of the controls this skill defines |
Resource Directories
Load these directories only when the selected workflow needs deeper examples, prompts, or reference material:
- references/
Final Output Contract
Every engagement produces:
- A prioritised list of applicable ASI categories with system-specific rationale.
- For each material risk, concrete prevention controls, detection signals, and remediation steps.
- Realistic attack-scenario framing suitable for defensive review or red-team planning.
- Clear assumptions, evidence gaps, and next actions for the engineering team.
Quality Gate
Do not mark this engagement complete until:
- Each cited ASI category is tied to a concrete system condition or threat path.
- Prevention, detection, and remediation guidance is present for every High/Critical issue.
- Generic AI-security advice has been replaced with agent-specific guidance.
Provenance
- Authors: OWASP Agentic Security Initiative (source) + restructured for agent consumption
- Spec version: 1.0
- Framework revision: 1.0.2
- Last updated: 2026-08-25
- Content based on: https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
Third-Party Attribution
Copyright: OWASP Foundation. License: Creative Commons Attribution-ShareAlike 4.0 (CC-BY-SA-4.0). Source: https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/. OWASP® is a registered trademark of the OWASP Foundation. Use does not imply endorsement.
Currency
- Date checked: 2026-08-25 (re-verified against primary sources)
- Grounding rule for consumers: verify any CVE identifier, framework version, or regulatory date against its owning source (the NVD/CVE record, the OWASP project page, the Official Journal) before relying on it in a deliverable - these facts age faster than this file's review cadence.
- OWASP ASI Top 10 (2026) titles and identifiers verified stable against the official OWASP release (published December 9, 2025) - no errata or revisions published since.
- 2026 evidence base woven into per-vulnerability files: AIVSS v0.8 (March 19, 2026), MCP CVE wave (Jan–Apr 2026 - OX Security's coordinated disclosure of April 15, 2026 alone yielded 10+ High/Critical CVEs across four attack families), A2A protocol v1.0 GA (April 9, 2026, Linux Foundation), Agent Card Poisoning (Keysight ATI, 2026), EchoLeak (CVE-2025-32711, CVSS 9.3), OWASP GenAI Exploit Round-up Q1 2026 (April 14, 2026), EU AI Act enforcement begins August 2, 2026 (Article 50 transparency, GPAI, and prohibited-practices obligations unaffected by the omnibus); high-risk obligations deferred by enacted law - Regulation (EU) 2026/1744 published in the Official Journal July 24, 2026 and in force July 27, 2026 - moving Annex III systems to December 2, 2027 and Annex I embedded systems to August 2, 2028.
- OWASP State of Agentic AI Security & Governance v2.01 (June 1, 2026): substantial update to the July 2025 first edition. Reframes agentic AI risk around evidence-based governance. Source: https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
- AsyncAPI npm supply chain compromise (July 15, 2026): GitHub Actions pwn request → import-time payload delivery via AsyncAPI npm package. Real-world example of build-time integrity failures that can poison agent dependencies (ASI04). Source: https://www.microsoft.com/en-us/security/blog/2026/07/15/explaining-asyncapi-npm-supply-chain-compromise-import-time-payload-delivery/
- Microsoft least-privilege guidance (July 16, 2026): "Least privilege for AI agents: Identity, access, and tool binding" provides concrete implementation patterns for ASI03 and ASI09. Source: https://www.microsoft.com/en-us/security/blog/2026/07/16/least-privilege-for-ai-agents-identity-access-and-tool-binding/
- Primary references to verify periodically:
- OWASP Top 10 for Agentic Applications: https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
- OWASP Agentic AI Threats and Mitigations Guide
- OWASP AI Vulnerability Scoring System (AIVSS): https://aivss.owasp.org/
- OWASP GenAI Exploit Round-up (quarterly): https://genai.owasp.org
- OWASP Top 10 for LLM Applications (companion reference)
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.