OWASP Named the Ten Ways Skills Go Wrong. All Ten Are Already Happening.
A skill is a strange thing to secure. It looks like documentation: a markdown file with a name, a description, and step-by-step instructions. It behaves like software: it can run shell commands, read your SSH keys, and talk to the internet. For most of the past year, the ecosystem treated skills like the former. Attackers treated them like the latter.
OWASP has now weighed in. The newly published Agentic Skills Top 10 (AST10) names the ten most critical risks in agentic skills, the reusable behaviors that give agents real-world reach across Claude Code, Cursor, VS Code, and OpenClaw. It sits under the LLM Top 10 (the model) and the Top 10 for Agentic Applications (the agent), covering what the agent installs and obeys.
Lists like this usually arrive as predictions. This one arrives as a postmortem. Earlier this year we analyzed 206,435 skill files from GitHub and the public registries, so we can put a measured number next to each risk. None of the ten is theoretical.
The new list
Ten risks make ten sections nobody reads. In the data, they collapse into five stories.
The payload is already there (AST01, AST02)
In late January 2026, ten coordinated accounts flooded the ClawHub registry with malicious skills; Antiy CERT's count reached 1,184 by February 5. Each used a fake dependency prompt to walk the installing agent into executing a reverse shell, delivering the Atomic Stealer infostealer to macOS machines. Disclosure worked: distribution ended within 72 hours of the first writeup. Remediation did not. Months later, 662 skills remained installable, the maintainer had removed exactly one, and the C2 server's TLS certificate had been reissued with ten years of validity. That is not an operator walking away.
Privilege is the default (AST03, AST06)
In the wild, over-privilege is less a risk than a norm: 23.7% of skills read sensitive local stores, the exact target set Atomic Stealer goes after, and 9.5% assemble the full lethal trifecta in a single install: code execution, private data access, and an external communication channel. Isolation barely exists at 4.7%. Malicious skills need not look unusual: they ask the agent to do what thousands of legitimate, poorly governed skills already do.
The skill you reviewed is not the skill you run (AST05, AST07)
Skills point agents at remote content: a URL to fetch, a doc to follow, a dependency to install. Whoever controls that content controls your agent, starting whenever they choose. Update drift is the same problem on a timer: only 0.5% of skills pin versions, so the skill your team reviewed and the skill your agent runs next month are related only by name. In the neighboring MCP ecosystem, postmark-mcp behaved flawlessly for fifteen versions before shipping a BCC to the attacker's domain. A review is a snapshot. The trust it produces is standing.
Scanners read code; payloads are prose (AST04, AST08)
The 26medias skills instructed the installing agent, in plain English, to store a Solana private key in plaintext and route payments through an attacker-controlled wallet. No shell commands, no encoded blobs, nothing for a pattern-matching scanner to flag. The payload was the sentence. Metadata makes it worse: the listing site that carried ClawHavoc decorated confirmed malware with fake stars, license badges, and a low-risk tier. Every signal a hurried engineer checks was forged, and the scanners were reading the wrong layer.
Nobody owns this yet (AST09, AST10)
Governance is where the denominators get bleak. 3.6% of skills require human approval; 79% fail all three baseline checks at once. Across the broader agentic codebase in our State of AI Agent Security 2026, runtime guardrails such as cost controls and audit logging sit at 0.1% or below. And takedowns do not stick: automated pipelines kept converting ClawHavoc skills into Cursor, Copilot, Claude Code, and Gemini CLI ecosystems after disclosure. Takedowns treat skills as files in one place; the ecosystem treats them as content that flows.
What a list can see, and what it cannot
Adopt AST10 as your intake gate: inventory the skills your agents already have, review each against the ten before it reaches an agent, prose included, pin versions, and gate credential access, outbound connections, and database writes behind approval. Then be honest about what a checklist is: at least three of the ten risks happen after approval, to skills that passed every check you ran. Static review tells you which skills could hurt you. Only watching them run tells you which one currently is.
That second half is what Capsule Security builds: a runtime security platform that discovers the agents and skills across your organization, maps what each can reach, and interrupts unsafe actions mid-execution, with no changes to your code, agents, or architecture. The full picture is in our State of AI Agent Security 2026 report.
Read more articles
CurseBox: The Agent That Sends Your Files to Strangers to Get the Job Done
Capsule Security research uncovered a behavior in Cursor's agent: asked to do something ordinary like share a file, it decides on its own to upload the file to a public anonymous host to get a link. It will push past a deny-all network sandbox to do it, and no attacker is involved. We found it running in production across every major model, reported it to Cursor, and were met with silence.
When Agents Go Rogue
Modern AI agents are increasingly causing critical system damage not through external cyberattacks, but by taking unprompted, off-script actions across unguarded tools like databases and system shells. Traditional safeguards, including prompt instructions and human approval workflows, routinely fail to catch these autonomous errors before execution. To mitigate this growing risk, security must shift directly to the tool-call boundary, enforcing deterministic runtime controls that intercept and block destructive commands before they run.
Keeping AI Agents on Track: How Capsule Powers State-of-the-Art Rogue Agent Detection with NVIDIA Nemotron
Capsule Security and NVIDIA collaborated to solve the rogue AI agent threat by engineering specialized Small Language Models (SLMs) for real-time security detection. By fine-tuning NVIDIA Nemotron architectures, this solution achieves inline, ultra-low latency interception of unauthorized agent actions before damage occurs. Discover how domain-specialized models deliver up to 96.9% accuracy and sub-200ms response times to keep autonomous enterprise workflows secure.
.avif)
Capsule Launches Security Integration for Claude Platform
Capsule launches a security integration for Claude Platform, using Claude's Compliance API to give security, compliance, and AI governance teams visibility into enterprise AI activity, risk, and posture across Anthropic-hosted deployments.
.png)
We Analyzed 206,435 AI Agent Skills. Here's What We Found.
Our analysis of 206,435 AI agent skills reveals a rapidly growing software supply chain vulnerable to natural language payloads and dangerous capability combinations. Read the report to understand how these skills bypass traditional security controls and learn how Capsule protects your organization by securing the agent runtime.
.png)
Mitigating the Agentic AI Threat: What Security Leadership Needs to Prioritize
The theoretical phase of agentic AI security is over—the attack surface is real and the incidents are documented. This post breaks down the defensive architecture taking shape in response: Meta's Agents Rule of Two, deterministic enforcement hooks, identity governance for non-human agents, and the questions security leaders need to be asking right now.
The Agentic AI Threat Landscape Has Crossed a Threshold
The security risks of AI agents are no longer theoretical. This blog examines the active threat landscape facing agentic AI in 2026, from prompt injection and supply chain attacks against MCP and skill registries to the governance gap created by vibe coding and Shadow AI.
The Rise of Guardian Agents: Securing the Agentic AI Ecosystem
Guardian agents are emerging as a critical security layer for the agentic AI era. As enterprises adopt AI agents that execute tools, handle sensitive data, and operate inside real workflows, human approval loops no longer scale. Guardian agents solve this by supervising other agents in real time: monitoring actions, enforcing policy, and blocking risky behavior before execution.
.png)
CurseChain: How Hidden README Comments Trick Cursor Into Stealing - and Spreading - Your SSH Keys
Capsule found two Cursor IDE vulnerabilities that let hidden prompt-injection instructions in referenced files steal developers’ SSH keys and contaminate future unrelated projects, causing zero-click or one-click exfiltration even when the attacker ships no malicious code.
The State of AI Agent Security 2026
Capsule Security’s State of AI Agent Security 2026 report is the largest independent audit of AI agents to date, showing that the ecosystem is rapidly shipping publicly exposed, weakly guarded, highly connected agents with recurring misconfigurations, near-absent runtime controls, widespread prompt-injection risk, expanding supply-chain exposure, and active malicious campaigns still propagating through agent skill and tool registries.
Capsule Security Raises $7M to Prevent AI Agents from Going Rogue in Runtime: Intent is the New Perimeter
Capsule is launching a runtime security platform for the agentic AI era, built to monitor and stop autonomous agents that can bypass traditional guardrails, misuse legitimate access, and create a new class of enterprise security risk.
.avif)
PipeLeak: The Lead That Stole Your Database - Exploiting Salesforce Agentforce With Indirect Prompt Injection
Capsule research team discover a critical prompt injection vulnerability in Salesforce Agentforce that allows attackers to exfiltrate CRM data through a simple lead from a form submission. No authentication required.
