| name | agentic-security-scanner |
| description | Scan and validate AI agent skills against the OWASP Agentic Skills Top 10 (AST10) security framework. Detects malicious skills, prompt injection, data exfiltration, supply chain risks, and cross-platform metadata loss. Provides CI/CD-ready security gating with SARIF output. |
| version | 1.0.0 |
| platforms | ["openclaw","claude","codex","cursor","gemini","copilot","opencode","windsurf"] |
| author | {"name":"Skill Foundry (Forge)","source":"OWASP Agentic Skills Top 10, SkillSpector Scanner"} |
| license | MIT |
| risk_tier | L1 |
| tags | ["security","owasp","scanner","ast10","compliance","supply-chain","ci-cd"] |
| requires | {"binaries":["jq","python3"]} |
Agentic Security Scanner
Scan and validate AI agent skills against the OWASP Agentic Skills Top 10
(AST10) — the definitive security framework for agent skill ecosystems.
Detect malicious skills, prompt injection sinks, data exfiltration paths,
supply chain risks, and cross-platform metadata loss before skills are
installed or published.
When to Use This Skill
Use this skill when:
- Auditing a new or existing skill before installation
- Setting up CI/CD security gates for a skill repository
- Reviewing a third-party skill for security compliance
- Building a skill registry that requires security validation
- Investigating a security incident involving agent skills
- Any request like "scan this skill for security issues", "OWASP audit",
"is this skill safe?", "validate skill security"
The OWASP AST10 Framework
The OWASP Agentic Skills Top 10 (AST10) defines the 10 most critical
security risks in AI agent skills across all major platforms:
OpenClaw (SKILL.md), Claude Code (skill.json), Cursor/Codex
(manifest.json), and VS Code (package.json).
AST01 — Malicious Skills
Skills that contain hidden destructive commands, backdoors, or malware.
- Detection: Scan for obfuscated shell commands, eval() calls,
encoded payloads, suspicious curl/wget patterns
- Risk: Remote code execution on skill installation or invocation
- CVEs: CVE-2025-59536 (CVSS 8.7), CVE-2026-21852 (CVSS 5.3)
AST02 — Prompt Injection in Skill Instructions
Skills with instructions that can be overridden by user input, causing
the agent to execute unintended actions.
- Detection: Check for unparameterized instruction templates,
missing input sanitization, trust of external content
- Risk: Agent follows attacker-controlled instructions instead of
skill author intent
AST03 — Data Exfiltration via Skills
Skills that send sensitive data (env vars, API keys, source code) to
external endpoints without disclosure.
- Detection: Find network calls in skill scripts, check for
unrestricted file read permissions, audit telemetry endpoints
- Risk: Secrets leakage, intellectual property theft
AST04 — Excessive Permissions
Skills requesting broader permissions than their stated purpose requires.
- Detection: Compare declared permissions vs. actual usage
