OWASP Publishes First Security Watchlist for AI Agent 'Skills'
A real attack in July exposed more than 300,000 users to stolen credentials through fake AI skills. Now the group behind the web's most-used security checklists has named the top ten risks, and 'malicious skills' sits at number one.
Key points
- OWASP released its first-ever Top 10 security risk list specifically for agentic AI skills in August 2025.
- A July 2025 attack using fake skills on the Paperclip AI platform racked up more than 300,000 installs per malicious package before detection.
- Supply chain compromise (risks from shared code repositories such as GitHub) ranks second on the list, behind malicious skills at number one.
- OWASP also released Universal Agentic Skill Format v1.0, a standard template designed to help automated tools spot suspicious skills before they run.
- Most organisations currently have no reliable way to tell which AI skills their staff are using, let alone whether any are malicious.
A criminal registered a web address designed to look like the address of Paperclip, a popular platform for AI agents (software that can browse, write, and take actions on a user's behalf), and used it to distribute booby-trapped software in early July 2025. Two things were planted: fake Python packages (bundles of reusable code that developers add to projects) and weaponised AI skills.
An AI skill is roughly what it sounds like: a set of instructions, written in plain language or code, that tells an AI agent how to carry out a specific task. Think of skills as apps for AI agents.
Automated scanners caught the fake Python packages within hours. The fake skills, however, slipped through undetected and were installed more than 300,000 times each. Stolen credentials and sensitive personal data were the prize.
Why did the skills go unnoticed for so long?
There is no widely accepted standard for what a legitimate skill looks like, so automated security tools have almost nothing to compare a suspicious skill against. That gap is exactly what the Open Worldwide Application Security Project (OWASP), the non-profit organisation best known for its authoritative lists of web security risks, set out to close.
This week OWASP published its Agentic AI Skills Top 10, a ranked watchlist of the ten biggest security risks specific to AI skills, together with the Universal Agentic Skill Format v1.0, a standard file template that gives security tools enough information to flag suspicious skills automatically.
| Rank | Risk | Severity |
|---|---|---|
| 1 | Malicious Skills | Critical |
| 2 | Supply Chain Compromise | Critical |
| 3 | Overprivileged Skills | High |
| 4 | Untrusted External Instructions (AST05) | High |
| 5-10 | Additional risks | High to Medium |
Niv Hoffman, co-lead of the OWASP project and co-founder of agentic supply-chain security startup Air, put it plainly: "If agents are the new operating system, then skills are the new applications."
Should organisations be worried?
Yes, and most are not prepared. Omar Turner, managing director of cloud and AI security at Microsoft and a contributor to the OWASP effort, told Dark Reading that the majority of security leaders cannot say how many AI agents their staff are running, let alone how many skills those agents are using.
That matters because the July attack used a tactic called typosquatting (registering a web address that looks nearly identical to a trusted one, betting that users will not notice the difference). Skills that appeared legitimate were quietly pulling instructions from a criminal-controlled site, a technique listed on the OWASP watchlist as "untrusted external instructions".
Skill repositories on GitHub grew by at least a third in the six months to August 2025, meaning the attack surface is expanding quickly.
The new standard skill format addresses part of the problem by recording where a skill came from, what permissions it needs, and a cryptographic signature (a kind of tamper-evident seal) that lets tools verify the skill has not been altered since its author published it.
What should affected users and organisations do?
If you use any AI agent platform at work or at home, check whether the platform publishes a list of approved skills and stick to it. Be sceptical of skills from unfamiliar authors or repositories, just as you would be cautious about downloading an app from an unknown website.
For security and IT teams, Turner's practical test is blunt: if a malicious skill were announced today, could you find every instance of it across your organisation and block it before close of business? If the honest answer is no, that is the gap to close first. Catalogue which agents your staff use, which skills those agents call on, and set up alerts for newly flagged skills.
