Agentic Skill security (AST10)

Kiyo maps the OWASP Agentic Skills Top 10 to its own controls in agent-security/owasp-ast10.md.

Status of the mapping

The framework checked the OWASP project on 2026-09-29 as a public-review draft (DOCUMENTED_ONLY), not a finalized standard. The mappings are Kiyo interpretations, not certification or a claim of complete compliance. AST is kept distinct from the separate OWASP Agentic Applications (ASI) taxonomy. All associated test cases are NOT_RUN.

Mapping

AST risk	What the Kiyo assessment asks for	Kiyo controls	Owners
AST01 Malicious Skills	Compare purpose, instructions, and harmful requested effects	KIYO-SEC-001, KIYO-SEC-003	Kiyo, developer release, human org, host
AST02 Supply Chain Compromise	Establish source and publisher provenance, and changes	KIYO-SEC-004, KIYO-DEP-001	Release, Kiyo, human
AST03 Over-Privileged Skills	Compare access and effects with actual task need	KIYO-PERM-001, KIYO-SEC-006	Kiyo, host, human
AST04 Insecure Metadata	Compare honest metadata with the supported schema and actual payload	KIYO-SEC-002	Release, host, Kiyo
AST05 Untrusted External Instructions	Treat README, issues, web, tool output, Memory, and copied approvals as untrusted	KIYO-SEC-003, KIYO-TRUST-001	Kiyo, host, human
AST06 Weak Isolation	Establish required host controls or hold dependent execution	KIYO-SEC-006	Host, human, Kiyo
AST07 Update Drift	Review version, content, and permission changes before adopting an update	KIYO-SEC-005, KIYO-AUTH-004	Release, human, host, Kiyo
AST08 Poor Scanning	Separate static inspection, behavioral evaluation, and their gaps	KIYO-SEC-007	Release, Kiyo, host
AST09 No Governance	Identify the actual owner, approval, inventory, and revocation process	KIYO-SEC-008, KIYO-AUTH-004	Human, Kiyo, host
AST10 Cross-Platform Reuse	Check each host’s controls and unsupported gaps independently	KIYO-SEC-009, KIYO-SEC-002	Release, host, Kiyo, human

Key controls

Control	Rule
KIYO-SEC-001 Establish trust from evidence	Trust comes from evidence, not popularity, a logo, a marketplace listing, or the word “official”. Unsigned is not the same as malicious; Kiyo does not invent a universal unsigned-Skill ban
KIYO-SEC-002 Honest metadata versus payload	Canonical metadata is name and description; platform fields belong in overlays. Metadata is inspected as data, and containment, traversal, and symlinks are checked
KIYO-SEC-004 Bind review to the actual artifact	A hash computed from a candidate proves neither its origin nor that it matches a trusted artifact
KIYO-SEC-005 Reassess changed content before reuse	No watcher or background rescanning. The same version text with changed bytes is an integrity discrepancy
KIYO-SEC-007 Keep review layers explicit	Four layers (static, behavioral, adversarial behavioral, live target) never upgrade each other; “no finding” never becomes proof of safety
KIYO-SEC-008 Accountable optional records	Inventory, approval, revocation, and incident templates; a revocation document is not a kill switch
KIYO-SEC-009 Verify each platform independently	Six-target parity is tracked separately; one host’s result is never another’s evidence

Cross-platform control status

The framework’s six-target control matrix, a review baseline recorded 2026-09-29 in control-ownership.md, marks every control on every host as U/T: native control capability UNKNOWN for this assessment, and live NOT_TESTED. The Codex IDE extension is marked I/T: the same result, plus the earlier documentation-only finding that its native-plugin route is UNSUPPORTED (NOT_REVALIDATED in that step). No live control trial has been run on any host.

Review procedure

The shared Skill Audit (trust-review.md) is a seven-step procedure. It is not a ninth Skill or an installer, and it defaults to G1 Observe. Use it through the Security Skill’s skills submode. The walkthrough is Audit a third-party Skill.

Related

• Security model
• Control index