All docs
OWASP Top 10 for Agentic Applications and Spellwarden rules Last updated 7 November 2026
The OWASP Top 10 for Agentic Applications lists ten risks of software in which a model plans and acts, from ASI01 to ASI10. This page shows, for each entry, the rules of the Spellwarden scanner that are tagged to it, as they are in scanner 1.9.1. An entry that no rule is tagged to says so.
On this page
About the list The ten entries About the list Read on 7 November 2026 at genai.owasp.org : the 2026 edition, published in December 2025 by the OWASP GenAI Security Project. The names below are the official names of the entries.
The scanner's tags are its own mapping of rules to entries, described with the OWASP columns of Scanner rules .
8 of 10 entries have at least one tagged rule.
The ten entries ASI01: Agent Goal Hijack Rules the scanner tags ASI01 Rule Title Default severity SW-SKL-001 Prompt-injection phrases in skill instructions High SW-SKL-002 Hidden text: zero-width or bidirectional control characters High SW-SKL-019 Fetches external URL content into context without an allowlist Medium SW-MCP-011 Tool description contains instruction-like text High SW-A2A-014 Agent card text contains injected instructions or hidden characters High
ASI02: Tool Misuse and Exploitation Rules the scanner tags ASI02 Rule Title Default severity SW-SKL-036 Frontmatter pre-approves an unscoped shell or interpreter Medium SW-CFG-012 MCP server configured to approve every tool call automatically High
ASI03: Identity and Privilege Abuse Rules the scanner tags ASI03 Rule Title Default severity SW-SKL-036 Frontmatter pre-approves an unscoped shell or interpreter Medium SW-CFG-013 Database or cluster MCP server with write access although a read-only mode exists High SW-A2A-005 OAuth implicit or password flow declared (deprecated in A2A 1.0) High SW-A2A-006 OAuth authorization code flow without PKCE required Medium SW-A2A-007 Agent declares no authentication Medium SW-A2A-008 API key sent in the URL query Medium SW-A2A-009 Skill inherits every scope of the agent Low SW-A2A-015 Credential in the agent card Critical
ASI04: Agentic Supply Chain Vulnerabilities Rules the scanner tags ASI04 Rule Title Default severity SW-SKL-004 Encoded payload decoded and executed (malicious indicator) Critical SW-SKL-007 Remote script piped to a shell High SW-SKL-009 Unpinned dependency install Medium SW-SKL-010 Bundled binary or executable file Medium SW-SKL-012 Reads a credential file path without stating purpose Medium SW-SKL-014 Obfuscated script code Medium SW-SKL-015 Frontmatter missing or invalid (name, description) Low SW-SKL-031 Missing license and version metadata Low SW-SKL-032 Instructions lure the user into running a password-protected download or a pasted script (malicious indicator) Critical SW-SKL-037 Executable downloaded from a moving reference and run without an integrity check Medium SW-MCP-004 HTTP+SSE transport (deprecated) Medium SW-MCP-005 Spec version older than 2026-07-28 Low SW-MCP-006 Protocol sessions (Mcp-Session-Id) in use Medium SW-MCP-007 Requires the initialize handshake; no server/discover Medium SW-MCP-008 Uses deprecated Roots, Sampling or Logging Medium SW-CFG-003 MCP server launched from an unpinned package Medium SW-CFG-005 Hook pipes remote content to a shell High SW-CFG-007 Hook decodes and runs an encoded payload (malicious indicator) Critical SW-CFG-009 Marketplace plugin source not pinned to a commit Medium SW-REG-001 Skill package not admitted in the organisation's private registry High SW-REG-003 Agent content the private registry cannot judge High
ASI05: Unexpected Code Execution (RCE) Rules the scanner tags ASI05 Rule Title Default severity SW-SKL-037 Executable downloaded from a moving reference and run without an integrity check Medium
ASI06: Memory & Context Poisoning No rule is tagged to this entry in scanner 1.9.1.
ASI07: Insecure Inter-Agent Communication Rules the scanner tags ASI07 Rule Title Default severity SW-A2A-001 Agent card does not follow A2A 1.0 Medium SW-A2A-002 Agent card uses a format older than A2A 1.0 Medium SW-A2A-003 Agent card at the path used before A2A 0.3 Medium SW-A2A-004 Agent endpoint or authentication URL not served over HTTPS High SW-A2A-010 Agent card signature does not verify High SW-A2A-011 Agent card signature is malformed or uses a refused algorithm High SW-A2A-012 Agent card is not signed Low SW-A2A-013 Signing key not bound to the card's host Medium SW-A2A-016 Agent card fetched through a redirect to another host Medium SW-A2A-017 Agent card signed with a shared secret that only the agent can check Medium SW-A2A-018 Agent card cannot be read High SW-A2A-019 Agent card member spelled two ways High
ASI08: Cascading Failures No rule is tagged to this entry in scanner 1.9.1.
ASI09: Human-Agent Trust Exploitation Rules the scanner tags ASI09 Rule Title Default severity SW-SKL-032 Instructions lure the user into running a password-protected download or a pasted script (malicious indicator) Critical
ASI10: Rogue Agents Rules the scanner tags ASI10 Rule Title Default severity SW-SKL-003 Instructions to skip approvals or disable hooks High SW-SKL-005 Writes to agent configuration High SW-SKL-006 Destructive command without a confirmation step Medium SW-SKL-008 Sends local file contents to an external host (malicious indicator) Critical SW-SKL-013 Network calls to raw IP addresses or URL shorteners Medium SW-CFG-004 MCP server at a raw IP address or behind a URL shortener Medium SW-CFG-006 Hook sends local file contents to an external host (malicious indicator) Critical SW-CFG-008 Settings switch off approval prompts High