OWASP's New AI Skills Security Blueprint: Defending Against Malicious AI Agent Add-Ons

The Open Worldwide Application Security Project (OWASP) has published a new Top 10 security list purpose-built for the modern AI era — this one targeting AI agent "skills," the pluggable add-ons that give large language model (LLM) agents new capabilities such as executing code, querying APIs, reading files, and interacting with enterprise systems. Alongside the risk list, OWASP debuted a Universal Skill Format intended to bring consistency, portability, and — critically — security to how these add-ons are packaged and distributed.

If your organization is deploying agentic AI — whether that's coding assistants, autonomous workflow agents, or MCP-connected tooling — this announcement is directly relevant to you. AI skills are rapidly becoming the new browser extension ecosystem: easy to install, rarely audited, over-privileged by default, and an increasingly attractive supply-chain target for threat actors. A single malicious or compromised skill can inherit every permission the host agent holds, which in many deployments means shell access, file system access, cloud credentials, and internal network reach.

This post breaks down what OWASP is flagging, why skills represent a meaningful new attack surface, and what your security team should do about it today — including detection engineering guidance for skill-abuse behaviors.

Technical Analysis

What Are AI "Skills" and Why Do They Matter?

AI skills (also called plugins, tools, or extensions depending on the platform) are modular capability packages installed into an AI agent runtime. They typically contain:

• Instruction content — natural-language instructions or prompts the agent loads into its context, effectively extending its system behavior
• Executable logic — scripts, code, or tool definitions the agent can invoke (shell commands, Python, API calls)
• Configuration and metadata — permissions declarations, endpoint definitions, and dependency manifests

The security problem is structural: skills execute with the full trust and permission set of the host agent, their instruction content is consumed by the model as authoritative context, and most ecosystems today have no standardized signing, review, or permission-scoping mechanism. That is precisely the gap OWASP's Universal Skill Format aims to close — defining a consistent, auditable packaging standard so security teams can inspect, validate, and govern skills before deployment.

The Risk Categories OWASP Is Flagging

While the exact list ordering will evolve, the risk classes OWASP highlights for AI skills map closely to what we're already seeing in incident response work involving agentic AI deployments:

1. Malicious skill supply chain — trojanized skills published to public registries or marketplaces, typosquatted skill names, and compromised maintainer accounts pushing poisoned updates. This mirrors the npm/PyPI playbook that attackers have refined for years.
2. Prompt injection via skill content — because skill instructions are ingested into the model's context, a crafted skill can override agent behavior, exfiltrate conversation data, or manipulate the agent into performing unauthorized actions. This is an indirect prompt injection vector with a persistent footprint.
3. Excessive permissions and scope creep — skills requesting broader access than their function requires (full file system, network egress, credential stores), with no enforcement mechanism to constrain them.
4. Credential and secret exposure — skills that read environment variables, cloud metadata endpoints, SSH keys, or token files accessible to the agent process.
5. Insecure tool execution — skills that wrap shell execution or code interpreters, enabling arbitrary command execution if the skill or its inputs are attacker-controlled.
6. Data exfiltration through tool calls — skills that transmit conversation content, files, or retrieved enterprise data to external endpoints under the guise of normal tool functionality.
7. Unvalidated dependencies — skills pulling in third-party packages or remote content at runtime without integrity verification.
8. Insufficient provenance and signing — no way to verify who authored a skill or whether it has been tampered with since publication.

Exploitation Status

There is no CVE associated with this announcement — it is a defensive framework publication, not a vulnerability disclosure. However, the underlying threat is neither theoretical nor future-tense. Security researchers have publicly demonstrated malicious MCP servers and agent plugins performing credential theft and silent data exfiltration, and prompt injection against tool-using agents is a documented, reproducible technique. Treat the skill ecosystem the way you treated browser extensions circa 2015: an unmanaged, high-privilege installation surface sitting inside your perimeter by invitation.

Detection & Response

Detecting malicious AI skill behavior requires focusing on the host agent process and its children, skill installation artifacts, and anomalous egress. The detections below target behaviors consistent with the OWASP risk categories: skill-driven command execution, credential file access, and suspicious skill content.

Sigma Rules

---
title: AI Agent Process Spawning Shell or Script Interpreter
id: 3f8a1c24-7b2d-4e91-a5c6-9d0e2f4a6b8c
status: experimental
description: Detects AI agent CLI runtimes (node, python-based agent tools) spawning command shells or script interpreters, consistent with a malicious or compromised AI skill executing system commands.
references:
  - https://www.darkreading.com/application-security/owasp-flags-top-ai-skill-risks-security-blueprint
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\python.exe'
      - '\python3.exe'
      - '\uv.exe'
      - '\deno.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\curl.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate AI coding assistants executing build or test commands in development workflows
  - Approved agentic automation invoking system tooling
level: high
---
title: Skill or Plugin Configuration Accessed by Non-Agent Process
id: 8c2e5f17-4a6b-4d38-b9c1-2e7f3a5d8b0e
status: experimental
description: Detects writes to AI agent skill/plugin directories by processes other than the agent runtime or package manager, indicating potential skill tampering or unauthorized skill installation.
references:
  - https://www.darkreading.com/application-security/owasp-flags-top-ai-skill-risks-security-blueprint
  - https://attack.mitre.org/techniques/T1565/001/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.defense_evasion
  - attack.t1565.001
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\.claude\skills\'
      - '\.config\claude\'
      - '\.cursor\'
      - '\mcp\servers\'
      - '\.continue\'
      - '\.windsurf\'
  filter_legit:
    Image|endswith:
      - '\node.exe'
      - '\python.exe'
      - '\npm.exe'
      - '\pip.exe'
      - '\claude.exe'
  condition: selection_path and not filter_legit
falsepositives:
  - Administrators manually editing skill configuration files
  - Endpoint management software deploying approved skill configurations
level: medium
---
title: Agent Process Reading Credential or Key Material (Linux)
id: 5d1a9b63-2f8c-4e47-a3d5-6b9c0e2f4a7d
status: experimental
description: Detects AI agent runtimes on Linux accessing SSH keys, cloud credential files, or token stores — a hallmark of malicious skill behavior and agent compromise.
references:
  - https://www.darkreading.com/application-security/owasp-flags-top-ai-skill-risks-security-blueprint
  - https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.credential_access
  - attack.t1552.001
  - attack.t1552.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/node'
      - '/python'
      - '/python3'
      - '/deno'
      - '/uv'
  selection_cmd:
    CommandLine|contains:
      - '/.ssh/id_'
      - '/.aws/credentials'
      - '/.azure/'
      - '/.config/gcloud/'
      - '/.kube/config'
      - '169.254.169.254'
      - '/etc/shadow'
  condition: selection_parent and selection_cmd
falsepositives:
  - Agent workflows explicitly designed for infrastructure automation with approved credential access
level: high

KQL Hunt Query (Microsoft Sentinel / Defender)

This query hunts across process and network telemetry for AI agent runtimes exhibiting skill-abuse behaviors: suspicious child processes, credential-path references, download-cradle patterns, and unexpected egress.

let AgentRuntimes = dynamic(["node.exe", "python.exe", "python3.exe", "deno.exe", "uv.exe", "claude.exe", "claude", "node", "python3"]);
let SuspiciousPatterns = dynamic(["curl", "wget", "iex", "Invoke-Expression", "base64 -d", "certutil", "id_rsa", ".aws/credentials", "169.254.169.254", ".ssh/", "nc ", "ncat", "bash -i"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any (AgentRuntimes) or FileName has_any (AgentRuntimes)
| extend CmdLine = ProcessCommandLine
| where CmdLine has_any (SuspiciousPatterns)
   or (InitiatingProcessFileName has_any (AgentRuntimes) and FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "curl.exe", "bash", "sh"))
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, CmdLine, ProcessId, InitiatingProcessId
| order by TimeGenerated desc;
// Correlate with unexpected egress from agent processes
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any (AgentRuntimes)
| where RemoteIPType == "Public" and RemotePort in (443, 80, 8080, 4444, 1337)
| summarize Connections = count(), RemoteIPs = make_set(RemoteUrl, 20) by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, bin(TimeGenerated, 1h)
| where Connections > 50
| order by Connections desc;

Velociraptor VQL Hunt

This artifact inventories AI skill/plugin directories across endpoints and flags skill files containing high-risk content patterns (download cradles, encoded payloads, credential paths, hardcoded endpoints) for analyst review.

-- Hunt: Inventory AI skill files and flag suspicious content patterns
LET skill_dirs = SELECT FullPath
FROM glob(globs=['C:/Users/*/.claude/skills/**/*', 'C:/Users/*/.cursor/**/*', '/home/*/.claude/skills/**/*', '/home/*/.config/claude/**/*', '/root/.claude/skills/**/*'])
WHERE NOT IsDir

LET flagged = SELECT FullPath,
       read_file(filename=FullPath, length=51200) AS Content
FROM skill_dirs
WHERE Content =~ '(?i)(curl\s+.*\||wget\s+.*\||Invoke-Expression|iex\s*\(|base64\s+(-d|--decode)|FromBase64String|id_rsa|aws_secret_access_key|169\.254\.169\.254|nc\s+-|bash\s+-i|/etc/shadow)'

SELECT FullPath,
       timestamp(epoch=Mtime) AS ModifiedTime
FROM foreach(row=skill_dirs, query={
    SELECT FullPath, Mtime FROM stat(filename=FullPath)
})
UNION ALL
SELECT FullPath, NULL AS ModifiedTime FROM flagged

Note: tune the glob paths to the agent platforms actually deployed in your environment — the skill directory conventions differ per vendor and will evolve as the Universal Skill Format gains adoption.

Hardening and Audit Script

Use this Bash script to audit Linux/macOS developer workstations and servers for installed AI skills, world-writable skill directories, and skills containing high-risk patterns. Run it via your EDR's live response or configuration management tooling.

#!/bin/bash
# AI Skill Security Audit - Security Arsenal
# Inventory skill directories, check permissions, scan for high-risk content

SKILL_DIRS=("$HOME/.claude/skills" "$HOME/.config/claude" "$HOME/.cursor" "$HOME/.continue" "/opt/mcp/servers")
REPORT="ai_skill_audit_$(hostname)_$(date +%Y%m%d).txt"

echo "=== AI Skill Security Audit: $(hostname) ===" | tee "$REPORT"
echo "Date: $(date)" | tee -a "$REPORT"

for dir in "${SKILL_DIRS[@]}"; do
  if [ -d "$dir" ]; then
    echo "[+] Found skill directory: $dir" | tee -a "$REPORT"
    # Flag world-writable or group-writable skill files
    find "$dir" -type f -perm /022 -exec ls -la {} \; | tee -a "$REPORT"
    # Scan for high-risk content patterns in skill files
    echo "  Scanning for high-risk patterns..." | tee -a "$REPORT"
    grep -rIlE '(curl .+\||wget .+\||base64 -d|id_rsa|aws_secret|169\.254\.169\.254|nc -|bash -i|eval\()' "$dir" 2>/dev/null | tee -a "$REPORT"
    # Fix overly permissive files
    find "$dir" -type f -perm /022 -exec chmod 600 {} \;
    find "$dir" -type d -perm /022 -exec chmod 700 {} \;
  fi
done

# Check for agent processes with unexpected outbound connections
echo "[+] Agent processes with active network connections:" | tee -a "$REPORT"
ss -tunp 2>/dev/null | grep -Ei '(node|python|deno)' | grep -v '127.0.0.1' | tee -a "$REPORT"

echo "[+] Audit complete. Review $REPORT for flagged items." | tee -a "$REPORT"

Remediation

Because this is a framework announcement rather than a patchable vulnerability, remediation is architectural and procedural. Prioritize the following:

1. Adopt the OWASP AI Skills Top 10 as your internal standard. Map every deployed agent skill against the listed risk categories. Skills you cannot account for should be removed.
2. Establish a skill allowlist. Prohibit ad-hoc installation of skills from public registries. Route all skill adoption through security review, the same way mature organizations govern browser extensions and IDE plugins.
3. Review and pin the Universal Skill Format. As OWASP's format matures, require skills to conform to it — a standardized manifest gives you a single inspection point for permissions, dependencies, and provenance.
4. Enforce least privilege on agent runtimes. Run agents in sandboxed environments (containers, dedicated service accounts, restricted shells) with no access to SSH keys, cloud instance metadata, or credential files unless explicitly required. Network-segment agent workloads and apply egress filtering — a skill that exfiltrates data needs a route out.
5. Scan skill content before deployment. Treat skill instruction files as code: static-analysis them for download cradles, encoded payloads, credential-path references, and hardcoded external endpoints. The audit script above provides a starting point.
6. Version-pin and verify integrity. Pin skills to reviewed versions, verify hashes where available, and monitor for unexpected updates to installed skills.
7. Instrument detection coverage. Deploy the Sigma, KQL, and VQL content above (tuned to your agent platforms) and ensure agent process telemetry — process creation with command line, network connections, and file access — is flowing to your SIEM.
8. Add skills to your threat model and IR playbooks. Define now what "malicious skill installed on a developer workstation" looks like as an incident: containment steps, credential rotation scope, and forensic acquisition of the agent's context and tool-call logs.

The trajectory here is predictable: every extensibility ecosystem eventually gets attacked, and the defenders who built governance before the first major supply-chain incident fared far better than those who reacted after. OWASP has handed you the blueprint. Use it.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub