OWASP Agentic Skills Top 10
The OWASP Agentic Skills Top 10 (v1.0-2026) lists the most critical security risks in AI agent skills. This page maps each one to what skillsvault does about it — and says plainly where it only helps in part, or not at all.
What skillsvault is
skillsvault governs which skills reach your agents and which may run: a registry, a runtime gate, signed policy, and an audit log. It does not sandbox or execute skills — the agent does. Read each row with that in mind.
| Risk | skillsvault | How |
|---|---|---|
| AST01 Malicious skills | Covered | Every published version is scanned for secrets, download-and-run commands (curl … | sh), hidden Unicode, padded whitespace, compiled binaries and encoded blobs, then given an AI review — except a version over 256 KB, which skips the AI review; the deterministic scan still covers every file. A ban blocks the skill on every machine, and the gate refuses it at invocation in Claude Code. |
| AST02 Supply-chain compromise | Partly | Versions are immutable and content-hashed; skills added from a source keep their origin, and an import that can't fetch every file is refused rather than stored half-complete. skillsvault doesn't resolve or vet a skill's own package dependencies. |
| AST03 Over-privileged skills | Covered | Every version's capabilities — the hosts it talks to, environment variables it reads, paths it writes, whether it runs a shell or installs packages — are read by a deterministic scan, shown on its page, and enforceable: a capability policy such as Block shell or Block network:pastebin.com stops matching skills on every machine and in every delivery. The scan reads what the content says; behaviour hidden from it is AST06's territory. |
| AST04 Insecure metadata | Covered | SKILL.md frontmatter is read as plain text — no YAML tags, no object deserialization, nothing executed — in the console, the API and the CLI. Text the CLI prints is stripped of terminal control codes. |
| AST05 Untrusted external instructions | Partly | The scan lists every external host a skill references and flags download-and-run patterns, so a skill that fetches instructions at run time is visible before it is approved. skillsvault can't see what a fetched URL returns later. |
| AST06 Weak isolation | Not covered | skillsvault doesn't execute skills, so it doesn't sandbox them. Run agents with the isolation your platform provides; use skillsvault to decide what they may run. |
| AST07 Update drift | Covered | Machines install exactly the version the signed policy bundle names: skillsvault pull verifies each skill's content against the bundle's Ed25519-signed hash and refuses anything that doesn't match. A new version reaches machines only when it is published and current — nothing auto-updates from upstream. |
| AST08 Poor scanning | Covered | Deterministic scanners catch what patterns can — including zero-width, bidirectional and tag characters, and whitespace padding that hides payloads — and a model reviews every file for intent the patterns miss, for versions up to 256 KB (larger ones get the deterministic scan only). Findings can be dismissed with a reason, and a dismissal reopens when the evidence changes. |
| AST09 No governance | Covered | This is what skillsvault is: an inventory of every skill (including what skillsvault scan finds already installed), approval through bans and policies, roles for who may publish, and a tamper-evident audit log of every decision. |
| AST10 Cross-platform reuse | Partly | One registry and one policy govern all 17 agents that load skills: pull installs the approved set into each and removes banned ones, and scan inventories every agent's skill folders the same way. The runtime gate is in Claude Code today; in the others, governance is what pull installs. |
Where to read more
- The runtime gate — how a decision is made on the machine, with no network call.
- Policies — Block, Warn and bans, and why the most restrictive one wins.
- Audit log — what each event records and how the hash chain is verified.
- Harness coverage — which agents get distribution and which get the runtime gate.