on demand Webinar

Inside the OWASP Agentic Skills Top 10: Securing the Agent Skill Ecosystem

Your developers are already installing agent skills — reusable bundles of instructions and resources that an AI agent can find, load, and run on its own. Almost none of it is signed, inventoried, or vetted.

That gap is already being exploited. The ClawHavoc campaign pushed 1,184 malicious skills from 12 publisher accounts, all reporting to the same command-and-control address. A USENIX Security 2026 study analyzed 98,380 skills across public marketplaces and confirmed 157 malicious skills carrying 632 vulnerabilities.

In August 2026, OWASP published the Agentic Skills Top 10 v1.0 — a community-built standard that maps ten risk classes across the full skill lifecycle (write, distribute, install, execute, update, govern) and ties them to AISVS, ASI, MCP Top 10, and LLM controls.

Watch this practical walkthrough of the standard and what it changes for teams already running agents in production.

Watch on demand


What you'll learn:

  • What the ten risk classes (AST01–AST10) actually cover, and which ones your current AppSec program has no visibility into
  • Why over-privileged skills, untrusted external instructions, and update drift break traditional code-centric scanning
  • How to build a trusted inventory of the skills, MCP servers, and tools your agents are pulling in today
  • How Evo Agentic Development Security from Snyk secures what your agents use, do, and generate — inside the agent execution loop

Speakers

Vandana_Circle.png

Vandana Verma
Sehgal

Staff Developer
Advocate

Snyk is trusted by the world’s most innovative companies.

© 2026 Snyk Limited
Registered in England and Wales
AISecEng Logo