Owasp Agentic — Agent Skill by Microsoft

From the author

OWASP Agentic Security Top 10 knowledge base for identifying, assessing, and remediating AI agent system security risks.

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The owasp-agentic skill provides a machine-readable implementation of the OWASP Top 10 for Agentic Applications (2026). It serves as a comprehensive reference for developers and security professionals to understand, detect, and mitigate critical vulnerabilities inherent in autonomous AI agent systems. The skill is organized into a vulnerability index and individual reference documents for each of the ten identified risk categories, offering actionable guidance on prevention, detection, and remediation.

What it does

Provides structured, machine-readable definitions for the OWASP Agentic Top 10 security risks.
Offers vulnerability checklists to help identify potential security gaps in agentic workflows.
Includes prevention controls and remediation strategies for each identified vulnerability.
Details attack scenarios to illustrate how agentic systems can be exploited.
Facilitates integration into security auditing and threat modeling processes for AI agents.

When to use it

During the design and architecture phase of building an AI agent system.
When performing security audits or threat modeling on existing agentic applications.
When developing guardrails or safety protocols for autonomous AI agents.
When training development teams on secure AI agent implementation practices.

Advantages

Standardized security framework based on industry-recognized OWASP research.
Machine-readable format allows for automated integration into agent development pipelines.
Provides concrete, actionable remediation steps rather than just theoretical risks.
Covers a wide range of agent-specific threats like goal hijacking and rogue agents.

Usage examples

“What are the primary risks associated with Agent Goal Hijack according to the OWASP Agentic Top 10?”: The agent retrieves the ASI01:2026 reference, explaining that goal hijack involves attackers manipulating an agent's objectives or decision pathways, and lists associated risks like unauthorized data exfiltration and financial fraud.
“Provide a checklist to assess if my agent is vulnerable to Tool Misuse and Exploitation.”: The agent references ASI02:2026 to provide a list of conditions and patterns that indicate potential tool misuse, along with recommended prevention controls like enforcing least privilege.

Install

Download the skill as a ZIP:
https://autogineer.com/agent-skills/microsoft/owasp-agentic/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip owasp-agentic.zip -d .agents/skills

Documentation by Microsoft

OWASP® Agentic Top 10 — Skill Entry

This SKILL.md is the entrypoint for the OWASP Agentic Top 10 skill.

The skill encodes the OWASP Top 10 for Agentic Applications (2026) as structured, machine-readable references that an agent can query to identify, assess, and remediate security risks in AI agent systems.

Normative references (Agentic Top 10)

Skill layout

SKILL.md — this file (skill entrypoint).
references/ — the Agentic Top 10 normative documents.
- 00-vulnerability-index.md — index of all vulnerability identifiers, categories, and cross-references.
- 01 through 10 — one document per vulnerability aligned with OWASP Agentic Security numbering.

Third-Party Attribution

Copyright © OWASP Foundation. OWASP® Top 10 for Agentic Applications (2026) content is derived from works by the OWASP Foundation, licensed under CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). Source: https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/ Modifications: Vulnerability descriptions restructured into agent-consumable reference documents with added detection and remediation guidance. OWASP® is a registered trademark of the OWASP Foundation. Use does not imply endorsement.

Files

ATTRIBUTION.mdAdded by AutoGineer981 B
LICENSEAdded by AutoGineer17.9 KiB
SKILL.md2.6 KiB
references/00-vulnerability-index.md3.1 KiB
references/01-agent-goal-hijack.md6.4 KiB
references/02-tool-misuse-and-exploitation.md6.1 KiB
references/03-identity-and-privilege-abuse.md6.4 KiB
references/04-agentic-supply-chain-vulnerabilities.md5.9 KiB
references/05-unexpected-code-execution.md6.0 KiB
references/06-memory-and-context-poisoning.md5.8 KiB
references/07-insecure-inter-agent-communication.md6.4 KiB
references/08-cascading-failures.md6.4 KiB
references/09-human-agent-trust-exploitation.md6.5 KiB
references/10-rogue-agents.md5.9 KiB

references/00-vulnerability-index.md

title: OWASP Agentic Top 10 Vulnerability Index description: Index of OWASP Top 10 for Agentic Applications (2026) vulnerability identifiers, categories, and cross-references

00 Vulnerability Index

This document provides the index for the OWASP Top 10 for Agentic Applications (2026) vulnerabilities. Each entry includes its identifier, title, and primary category.

Vulnerability catalog

ID	Title	Category
ASI01:2026	Agent Goal Hijack	Goal Integrity
ASI02:2026	Tool Misuse and Exploitation	Tool Security
ASI03:2026	Identity and Privilege Abuse	Access Control
ASI04:2026	Agentic Supply Chain Vulnerabilities	Supply Chain
ASI05:2026	Unexpected Code Execution	Execution Safety
ASI06:2026	Memory and Context Poisoning	Data Integrity
ASI07:2026	Insecure Inter-Agent Communication	Communication Security
ASI08:2026	Cascading Failures	Resilience
ASI09:2026	Human-Agent Trust Exploitation	Human Factors
ASI10:2026	Rogue Agents	Behavioral Integrity

Cross-reference matrix

Each vulnerability document follows a consistent structure:

Description — what the vulnerability is and how it manifests in agentic systems.
Risk — potential impacts and consequences of the vulnerability.
Vulnerability checklist — conditions and patterns that indicate the vulnerability is present.
Prevention controls — proactive measures to prevent the vulnerability.
Example attack scenarios — realistic exploitation narratives.
Detection guidance — how to detect if the vulnerability exists or is being exploited.
Remediation — concrete actions to fix identified instances.

Category groupings

Goal Integrity

ASI01:2026 Agent Goal Hijack

Tool Security

ASI02:2026 Tool Misuse and Exploitation

Access Control

ASI03:2026 Identity and Privilege Abuse

Supply Chain

ASI04:2026 Agentic Supply Chain Vulnerabilities

Execution Safety

ASI05:2026 Unexpected Code Execution

Data Integrity

ASI06:2026 Memory and Context Poisoning

Communication Security

ASI07:2026 Insecure Inter-Agent Communication

Resilience

ASI08:2026 Cascading Failures

Human Factors

ASI09:2026 Human-Agent Trust Exploitation

Behavioral Integrity

ASI10:2026 Rogue Agents

OWASP Top 10 for LLM Applications (2025) — foundational LLM risks that agentic vulnerabilities build upon.
OWASP Agentic AI Threats and Mitigations Guide — detailed threat modeling for agentic systems.
OWASP AI Vulnerability Scoring System (AIVSS) — severity scoring framework for AI-specific risks.

Content derived from works by the OWASP Foundation, licensed under CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). Modifications: Restructured into agent-consumable reference format with added detection and remediation guidance.

Requirements and compatibility

Written for: GitHub Copilot, Claude Code

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Claude Code frontmatter

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Security Audit
CloudflareOfficial
A structured, source-first security audit and vulnerability research framework for codebases and services.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskHas scriptsGitHub stars of the source repository65.3k
Sast Configuration
Seth Hobson· Community
Configure and optimize Static Application Security Testing (SAST) tools like Semgrep, SonarQube, and CodeQL for automated vulnerability detection.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskGitHub stars of the source repository42.3k
Firmware Analyst
Seth Hobson· Community
An expert firmware analyst providing structured guidance for embedded systems security, reverse engineering, and vulnerability research.
SecurityClaude Code
MITLow riskGitHub stars of the source repository42.3k
Policy Enforcer
Seth Hobson· Community
Expert guide for authoring and auditing Cedar authorization policies to secure Claude Code agent tool interactions.
SecurityClaude Code
MITGitHub stars of the source repository42.3k
Backend Development Security Auditor
Seth Hobson· Community
A specialized security auditor for identifying vulnerabilities in backend code and architecture during feature development.
SecurityClaude Code
MITGitHub stars of the source repository42.3k
Memory Forensics
Seth Hobson· Community
Master memory forensics and incident response using the Volatility framework and industry-standard acquisition tools.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskGitHub stars of the source repository42.3k

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download owasp-agentic.zip