By ByteBot
Five of the top seven most-downloaded AI agent skills at peak infection during the ClawHavoc campaign were confirmed malware. Not flagged, not suspected — confirmed. OWASP published the framework that explains how this keeps happening: the Agentic Skills Top 10 (AST10), released August 17, 2026, following Black Hat and DEF CON. If you’re building with or deploying AI agents, this is the document you need.
A quick definition: an agentic skill is a reusable bundle of instructions, code, and resources that an AI agent discovers, loads, and runs autonomously. Physically, it’s a folder with a SKILL.md file — YAML metadata header and plain-language instructions — plus any scripts those instructions reference. The skill runs with the host agent’s full permissions. Not a sandboxed subset. The whole thing. And because the instructions are prose, not code, every scanner built to inspect code walks right past them.
The Numbers That Should Alarm You
OWASP’s case studies draw directly from 2026 incidents. A USENIX Security 2026 measurement study analyzed 98,380 skills across public marketplaces and confirmed 157 malicious skills carrying 632 vulnerabilities. Seventy-three percent of those malicious skills implemented shadow features — behaviors hidden from the user that weren’t in the skill’s description. Fifty-four percent traced back to a single publisher cluster.
Five of the top seven most-downloaded ClawHub skills at peak infection were confirmed malware. Three lines of markdown were enough to exfiltrate SSH keys.
The ClawHavoc campaign, disclosed in February 2026, is the headline number: 1,184 malicious skills from 12 publisher accounts compromised an estimated 300,000 users over 17 days. The payload was Atomic macOS Stealer (AMOS) — browser credentials, keychain passwords, cryptocurrency wallets, SSH keys, Telegram session data. The skills delivering it were disguised as crypto trading bots, productivity utilities, and social media tools. They were in the top seven most-downloaded skills on the ClawHub registry.
What the OWASP Agentic Skills Top 10 Actually Says
The framework identifies ten risks across two severity tiers — two critical, four high, four medium. The critical two are the ones already being actively exploited:
- AST01 — Malicious Skills (Critical): Skills published without verification, impersonating trusted names like “Google” or “YouTube Summarize Pro.” No publisher verification mechanism existed at scale in any major registry.
- AST02 — Supply Chain Compromise (Critical): Skill files that pull typosquatted dependencies; the same malicious payload pushed to multiple registries simultaneously with no cross-registry intelligence sharing.
- AST03 — Over-Privileged Skills (High): Skills requesting write access to identity files they have no business touching, because there’s no permission boundary between the skill and the host agent.
- AST04 — Insecure Metadata (High): Spoofed YAML headers carrying brand names they have no right to.
- AST05 — Untrusted External Instructions (High): Skills that fetch and execute external instructions at runtime, outside any review process.
- AST06 — Weak Isolation (High): No sandboxing — skills execute with the full authority of the host agent.
- AST07–AST10 (Medium): Update drift, poor scanning, missing governance, and cross-platform reuse.
AST10 fills a specific gap. OWASP’s earlier “Top 10 for Agentic Applications” (December 2025) addressed application-level risks — agent goal hijacking, tool misuse, memory poisoning. That framework never reached the skill layer. This one does.
Why Your Scanner Won’t Save You
This is the point most teams haven’t internalized: existing security tooling is blind to the actual threat surface. Every open-source skill scanner tested at AST10’s publication failed against encoded payloads. False positive rates on legitimate skills ranged from 9% to 62%. A scanner that flags 62% of your good skills as malicious isn’t a security tool — it’s noise that trains your team to ignore alerts.
The reason is architectural. Code scanners parse syntax. Skills are prose. You can embed a payload in a sentence, in a base64 blob inside a comment, in an instruction that references an external URL — and pattern matching sees nothing. OWASP’s AST08 addresses this: behavioral scanning at publish time and install time, not just pattern matching. Adversa’s breakdown of AST10 explains why this gap exists and what behavioral scanning actually needs to catch.
What to Do Now
OWASP’s Security Assessment Checklist is the starting point. The practical immediate steps:
- Run a skill inventory. List every installed skill across Claude Code, Cursor, Codex, and OpenClaw. If you don’t know what’s running with your agent’s permissions, you can’t defend it.
- Verify publisher signatures. Require ed25519 cryptographic signatures on all skills. Reject unsigned installs. AST01’s prevention guidance covers the implementation details.
- Audit permissions. Revoke write access to identity files for any skill that doesn’t explicitly need it. Apply least privilege to skills the same way you apply it to IAM roles.
- Enable audit logging. Emit structured logs for all skill actions: file access, shell commands, network calls, memory writes. AST09 gives the full logging spec.
- Cross-reference your installs. The ClawHavoc IOC list and USENIX 2026 indicators are publicly available. Check installed skills against them now.
Apollo Research’s Watcher is worth evaluating as a complementary control — it blocks 93% of high-severity coding agent actions with under 1% false positives and integrates directly with Claude Code and Codex. It doesn’t replace AST10 governance, but it addresses the AST08 gap while you build longer-term controls.
The attack surface for AI agents has never been the model. It’s the install flow — what you put next to the model without verifying. AST10 makes that argument with receipts from real 2026 incidents. The ClawHavoc numbers say it plainly: 300,000 users, 17 days, five of seven top skills. Your skill inventory is your attack surface. Treat it like one.
