OWASP Agentic Skills Top 10 and Spellwarden rules
Last updated 7 November 2026
The scanner has no AST tags. This is Spellwarden's own mapping: Spellwarden's reading of which rules bear on each entry of the OWASP Agentic Skills Top 10. It is not a tag that the scanner writes, and it can change when the list changes.
About the list
Read on 7 November 2026: the project's repository marks AST01 to AST10 as drafts, with write-ups targeted at the second and third quarters of 2026 and version 1.0 targeted at the fourth quarter of 2026. The project's page on owasp.org shows Latest Version 1.0-2026 and Incubator Project. This page does not treat the list as settled.
The names below are the entries' names as the repository gives them. The other two OWASP pages show the scanner's own tags: OWASP MCP Top 10 and Spellwarden rules and OWASP Top 10 for Agentic Applications and Spellwarden rules.
The ten entries
AST01: Malicious Skills
Rules whose open finding quarantines a skill.
| Rule | Title | Default severity |
|---|---|---|
| SW-SKL-004 | Encoded payload decoded and executed (malicious indicator) | Critical |
| SW-SKL-008 | Sends local file contents to an external host (malicious indicator) | Critical |
| SW-SKL-032 | Instructions lure the user into running a password-protected download or a pasted script (malicious indicator) | Critical |
AST02: Supply Chain Compromise
Remote code, unpinned installs and downloads, bundled binaries and unpinned plugins.
| Rule | Title | Default severity |
|---|---|---|
| SW-SKL-007 | Remote script piped to a shell | High |
| SW-SKL-009 | Unpinned dependency install | Medium |
| SW-SKL-010 | Bundled binary or executable file | Medium |
| SW-SKL-037 | Executable downloaded from a moving reference and run without an integrity check | Medium |
| SW-CFG-003 | MCP server launched from an unpinned package | Medium |
| SW-CFG-009 | Marketplace plugin source not pinned to a commit | Medium |
AST03: Over-Privileged Skills
A pre-approved shell, instructions to skip approvals, and writes to agent configuration.
| Rule | Title | Default severity |
|---|---|---|
| SW-SKL-036 | Frontmatter pre-approves an unscoped shell or interpreter | Medium |
| SW-SKL-003 | Instructions to skip approvals or disable hooks | High |
| SW-SKL-005 | Writes to agent configuration | High |
AST04: Insecure Metadata
Frontmatter, and licence and version metadata.
| Rule | Title | Default severity |
|---|---|---|
| SW-SKL-015 | Frontmatter missing or invalid (name, description) | Low |
| SW-SKL-031 | Missing license and version metadata | Low |
AST05: Untrusted External Instructions
Instructions in a skill's text, hidden text, and external content fetched into context.
| Rule | Title | Default severity |
|---|---|---|
| SW-SKL-001 | Prompt-injection phrases in skill instructions | High |
| SW-SKL-002 | Hidden text: zero-width or bidirectional control characters | High |
| SW-SKL-019 | Fetches external URL content into context without an allowlist | Medium |
AST06: Weak Isolation
No rule judges how a skill is isolated from the rest of the system.
Spellwarden maps no rule to this entry.
AST07: Update Drift
Moving references: the reviewed version and the running version can differ.
| Rule | Title | Default severity |
|---|---|---|
| SW-SKL-009 | Unpinned dependency install | Medium |
| SW-SKL-037 | Executable downloaded from a moving reference and run without an integrity check | Medium |
| SW-CFG-003 | MCP server launched from an unpinned package | Medium |
| SW-CFG-009 | Marketplace plugin source not pinned to a commit | Medium |
AST08: Poor Scanning
The entry is about a lack of scanning, so no rule maps to it. Spellwarden itself is the response to this entry, not one of its rules.
Spellwarden maps no rule to this entry.
AST09: No Governance
Admission to the private registry, which runs in connected mode on the Enterprise plan.
| Rule | Title | Default severity |
|---|---|---|
| SW-REG-001 | Skill package not admitted in the organisation's private registry | High |
| SW-REG-002 | MCP server not admitted in the organisation's private registry | High |
| SW-REG-003 | Agent content the private registry cannot judge | High |
AST10: Cross-Platform Reuse
No rule judges whether a skill is reused across platforms.
Spellwarden maps no rule to this entry.