In early July, a cyberattacker reserved a look-alike domain impersonating a popular agentic AI work platform, Paperclip, and produced both Trojanized Python packages and weaponized AI skills to compromise users’ machines and steal a variety of credentials and sensitive information. The incident showcases why the Open Worldwide Application Security Project (OWASP) decided to poll practitioners earlier this year on that type of risk, which has now resulted in a first-of-its-kind candidate list of the top 10 security issues for agentic skills. Holding the current No. 1 spot? Malicious Skills.
The ability to add on features and capabilities through “skills” — natural-language and coded recipes for agentic platforms — makes AI agents much more capable but also adds a significant vector for untrusted input and malicious code, while a lack of security models and capabilities makes even legitimate skills subject to abuse. So, the OWASP move appears necessary: In the July incident, for example, automated scanners detected the Python packages within hours. The Trojanized skills, however, escaped detection and quickly racked up more than 300,000 installs each, according to research published on Aug. 6.
Inside OWASP’s Fresh Top 10 AI Skills Risk List
This week, OWASP released its final version of the list and an initial attempt at a standardized YAML format for skills files that can help automated analysis determine which skills are legitimate and which are not.
The intent of the list is to highlight the dangers posed by skills and the risks that agent developers should address, says Omar Turner, a security practitioner supporting the effort whose day job is managing director of cloud and AI security projects at Microsoft. He tells Dark Reading that many discussions at the recent Black Hat USA Conference focused on agents, but few focused on skills.
“Without the knowledge of what risks could exist with skills, you’re kind of operating blind,” he says in his OWASP-support capacity. “The concept of skills, the risks with skills, and the potential of threat actors could leverage skills in a certain way has to be reviewed and thought about with a conversation in organizations just like agents are right now.”
Skills are essentially scripts for agents that are often written in natural language but can also use code and have references to other sources, such as websites and model context protocol (MCP) servers. They represent a major source of untrusted input in the agentic architectures that are currently the leading edge of business efforts to incorporate AI into their operations, says Niv Hoffman, a co-lead of the OWASP project and co-founder and chief technology officer of Air, an agentic supply chain security startup.
“If agents are the new operating system, then skills are the new applications, and you must have them to unlock [all of the capabilities] of the agent,” he says. “Although skills can have risks, we do not recommend to forbid … people from using them, but to use them in a secure-by-default environment — to create a place where people and agents can adopt as many skills as they can in a secured way.”
Supply Chains, External Resources Top List
The OWASP Agentic Skills Top 10 list has two critical security risks, four high-severity risks, and four medium-severity risks. The top risk remains Malicious Skills, but the second critical risk — and No. 2 on the list — is Supply Chain Compromise. Skills hosted on GitHub and other repositories are potential vectors for attack, often using regular text files to pull typosquatted dependencies, according to OWASP.
Agentic-security startup Air was able to gain a high star count for its experimental repository through manipulating the repository system and affect 26,000 agents within hours.
Part of Air’s success was another major security issue: The ability to pull from external sites (AST05 – Untrusted External Instructions). The attack used a skill that created a landing page for a product but pulled instructions for creating the page from a site, a widely used tactic to add malicious functionality to otherwise legitimate-looking skills.
Malicious skills, supply chain risks, and overprivileged skills are the top 3 security issues on OWASP’s list of agentic-skills risks. Source: OWASP
Even legitimate skills created by users often seek out information from other sites, without checking that the information has changed or been compromised with malicious instructions, says Turner.
“When I’ve created skills personally, I’m going out to different sites and then pull from this, review this, provide me an output, take certain credentials that I have and do certain things,” he says. “If I was a CISO, that would keep me up at night because those external instructions connecting to bad sources would be very, very problematic.”
The Universal Skill Format: Making Skills More Consistent
As skills have taken off — with repositories growing by at least a third in the past six months — the need for a more standardized format for skills has grown as well. To address that need, OWASP also released the Universal Agentic Skill Format v1.0, a YAML format that can act as a template for creating skills with enough security signals to help automated software verify legitimate skills and detect malicious ones. The content format includes sections for provenance, permissions for different actions, requirements and dependencies, signatures and hashes, and a changelog.
An important function of the format is to help agents separate user instructions from those instructions that may come from skills or other content that are parsed by the agent, Air’s Hoffman says.
“From the agent’s perspective and the model perspective, there is no separation of user mode and current mode, and that’s why we created the universal skill format in order to create this new segmentation and boundaries,” he says. “What we are aiming to do with the top 10 skills is to take the best practices and the lessons we learned from 20 or 30 years with code programming and apply them to this new form of software as fast as possible.”
Companies Need Visibility Into AI Skills
Like cloud computing, AI capabilities and services are likely moving toward a shared responsibility model. Companies should expect their vendors to vet any skills that AI agents access if the agent is hosted on the AI-services firm’s infrastructure. However, organizations should not count on their suppliers and instead focus on both visibility and governance, both experts say.
As a first step, organizations need to grasp their current exposure to skills by taking stock of not only what agents their workers are using, but what skills those agents are tapping as well. A key performance metric is whether the company — once an alert about a malicious skill is published — can quickly determine whether that skill is in use and block it across the organization, says Microsoft’s Turner.
“Most CISOs can’t honestly say how many agents are running and how many skills are embedded within agents,” he says, adding that organizations without visibility likely could not respond to a malicious incident. “If you found through a source that a skill was malicious, how quickly could your organization turn that off at scale or disconnect that at scale? That is something I think CISOs really need to start thinking about.”
Comments are closed