owasp-agentic
OWASP Agentic Security Top 10 vulnerability knowledge base for identifying, assessing, and remediating security risks in AI agent systems - Brought to you by microsoft/hve-core.
Best use case
owasp-agentic is best used when you need a repeatable AI agent workflow instead of a one-off prompt.
OWASP Agentic Security Top 10 vulnerability knowledge base for identifying, assessing, and remediating security risks in AI agent systems - Brought to you by microsoft/hve-core.
Teams using owasp-agentic should expect a more consistent output, faster repeated execution, less prompt rewriting.
When to use this skill
- You want a reusable workflow that can be run more than once with consistent structure.
When not to use this skill
- You only need a quick one-off answer and do not need a reusable workflow.
- You cannot install or maintain the underlying files, dependencies, or repository context.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/owasp-agentic/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How owasp-agentic Compares
| Feature / Agent | owasp-agentic | Standard Approach |
|---|---|---|
| Platform Support | Not specified | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
OWASP Agentic Security Top 10 vulnerability knowledge base for identifying, assessing, and remediating security risks in AI agent systems - Brought to you by microsoft/hve-core.
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
SKILL.md Source
# OWASP® Agentic Top 10 — Skill Entry This `SKILL.md` is the **entrypoint** for the OWASP Agentic Top 10 skill. The skill encodes the **OWASP Top 10 for Agentic Applications (2026)** as structured, machine-readable references that an agent can query to identify, assess, and remediate security risks in AI agent systems. ## Normative references (Agentic Top 10) 1. [00 Vulnerability Index](references/00-vulnerability-index.md) 2. [01 Agent Goal Hijack](references/01-agent-goal-hijack.md) 3. [02 Tool Misuse and Exploitation](references/02-tool-misuse-and-exploitation.md) 4. [03 Identity and Privilege Abuse](references/03-identity-and-privilege-abuse.md) 5. [04 Agentic Supply Chain Vulnerabilities](references/04-agentic-supply-chain-vulnerabilities.md) 6. [05 Unexpected Code Execution](references/05-unexpected-code-execution.md) 7. [06 Memory and Context Poisoning](references/06-memory-and-context-poisoning.md) 8. [07 Insecure Inter-Agent Communication](references/07-insecure-inter-agent-communication.md) 9. [08 Cascading Failures](references/08-cascading-failures.md) 10. [09 Human-Agent Trust Exploitation](references/09-human-agent-trust-exploitation.md) 11. [10 Rogue Agents](references/10-rogue-agents.md) ## Skill layout * `SKILL.md` — this file (skill entrypoint). * `references/` — the Agentic Top 10 normative documents. * `00-vulnerability-index.md` — index of all vulnerability identifiers, categories, and cross-references. * `01` through `10` — one document per vulnerability aligned with OWASP Agentic Security numbering. ## Third-Party Attribution Copyright © OWASP Foundation. OWASP® Top 10 for Agentic Applications (2026) content is derived from works by the OWASP Foundation, licensed under CC BY-SA 4.0 (<https://creativecommons.org/licenses/by-sa/4.0/>). Source: <https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/> Modifications: Vulnerability descriptions restructured into agent-consumable reference documents with added detection and remediation guidance. OWASP® is a registered trademark of the OWASP Foundation. Use does not imply endorsement. --- *🤖 Crafted with precision by ✨Copilot following brilliant human instruction, then carefully refined by our team of discerning human reviewers.*
Related Skills
owasp-top-10
OWASP Top 10 for Web Applications (2025) vulnerability knowledge base for identifying, assessing, and remediating security risks in web application environments - Brought to you by microsoft/hve-core.
owasp-llm
OWASP Top 10 for LLM Applications (2025) vulnerability knowledge base for identifying, assessing, and remediating security risks in large language model systems - Brought to you by microsoft/hve-core.
pr-reference
Generates PR reference XML containing commit history and unified diffs between branches with extension and path filtering. Includes utilities to list changed files by type and read diff chunks. Use when creating pull request descriptions, preparing code reviews, analyzing branch changes, discovering work items from diffs, or generating structured diff summaries. - Brought to you by microsoft/hve-core
security-reviewer-formats
Format specifications and data contracts for the security reviewer orchestrator and its subagents - Brought to you by microsoft/hve-core.
jira
Jira issue workflows for search, issue updates, transitions, comments, and field discovery via the Jira REST API. Use when you need to search with JQL, inspect an issue, create or update work items, move an issue between statuses, post comments, or discover required fields for issue creation. - Brought to you by microsoft/hve-core
hve-core-installer
Decision-driven installer for HVE-Core with 6 clone-based installation methods, extension quick-install, environment detection, and agent customization workflows - Brought to you by microsoft/hve-core
gitlab
Manage GitLab merge requests and pipelines with a Python CLI - Brought to you by microsoft/hve-core
vscode-playwright
VS Code screenshot capture using Playwright MCP with serve-web for slide decks and documentation - Brought to you by microsoft/hve-core
video-to-gif
Video-to-GIF conversion skill with FFmpeg two-pass optimization - Brought to you by microsoft/hve-core
powerpoint
PowerPoint slide deck generation and management using python-pptx with YAML-driven content and styling - Brought to you by microsoft/hve-core
cyber-owasp-review
Map application security findings to OWASP Top 10 categories and generate remediation checklists. Use for normalized AppSec review outputs and category-level prioritization.
agentic-workflow-automation
Generate reusable multi-step agent workflow blueprints. Use for trigger/action orchestration, deterministic workflow definitions, and automation handoff artifacts.