OWASP profile assessment
OWASP Agentic Skills Top 10
Assess an agent skill package against the OWASP Agentic Skills Top 10. The result tells you what was assessed, what evidence was observed, which gaps were identified, and what could not be assessed — and, if you ask, carries a cryptographic signature from Agent Verify.
Only AST02, AST03 and AST04 are implemented in this profile version. Every other control is not assessed, which is not a pass.
Assessed against the OWASP Agentic Skills Top 10 (CC-BY-SA-4.0) at the pinned upstream commit. Not an OWASP certification or endorsement.
Three statuses, never a pass/fail
Evidence supporting the expected security property was observed.
Agent Verify observed evidence of a security gap.
Agent Verify did not have sufficient evidence to reach a determination. This is not a pass.
Run it
Dashboard
Sign in, open Scan, and choose “OWASP Agentic Skills profile.” Tick “Request cryptographic signing” for a signed result.
CLI
agentverify scan ./my-skill --profile owasp-agentic-skills-2026
API
POST /v1/scan with profile, and optionally attest: true. Read the docs.
A profile assessment, signed or unsigned, uses one scan from your normal monthly quota. Signing does not change the result.
Sample assessment — synthetic skill
Below is the real output of Agent Verify's assessment engine for a synthetic “expense approver” skill, not a customer's package. This sample is unsigned; signed assessments show an extra attestation section and can be checked against the published signing key.
Show the skill package that was assessed
// SKILL.md
---
name: expense-approver
description: Reviews expense reports and submits approved ones to the finance system.
version: 1.2.0
author: Example Finance Tools
license: MIT
tools:
- shell_exec
- http_request
permissions:
- filesystem:write
- network:external
---
# Expense Approver
Reads an expense report, checks each line item against policy, and submits the approved report to the finance API.
## Instructions
1. Read the report from the path the user provides.
2. Validate each line item against the expense policy.
3. POST the approved report to the finance API.
// package.json
{
"name": "expense-approver",
"version": "1.2.0",
"dependencies": {
"requests": "^2.25.0",
"finance-sdk": "latest"
},
"scripts": {
"postinstall": "node scripts/setup.js"
}
}OWASP profile assessment
OWASP Agentic Skills Top 10
Only AST02, AST03 and AST04 are implemented in this profile version. Every other control is not assessed, which is not a pass.
Assessed against the OWASP Agentic Skills Top 10 (CC-BY-SA-4.0) at the pinned upstream commit. Not an OWASP certification or endorsement.
Controls
Not implemented in this profile version — no evidence was collected for this control. This is not a pass.
Not implemented in this profile version — no evidence was collected for this control. This is not a pass.
Not implemented in this profile version — no evidence was collected for this control. This is not a pass.
Not implemented in this profile version — no evidence was collected for this control. This is not a pass.
Not implemented in this profile version — no evidence was collected for this control. This is not a pass.
Not implemented in this profile version — no evidence was collected for this control. This is not a pass.
Not implemented in this profile version — no evidence was collected for this control. This is not a pass.