How to use the OWASP ASI Risk Classifier agent skill

What the owasp-asi skill makes the agent do

An agent skill is a folder with a SKILL.md file that the agent can load when a task matches it. This one holds classification tables for the OWASP Top 10 for Agentic Applications 2026, labeled ASI01 to ASI10. Examples include ASI01 Agent Goal Hijack, ASI02 Tool Misuse & Exploitation, ASI04 Agentic Supply Chain and ASI10 Rogue Agents.

The skill does not scan anything. It contains no scanning logic and cannot inspect a codebase or agent by itself. It only organizes findings that come from somewhere else, such as an agent security scanner or a manual review.

• Maps each finding to a risk ID using the included tables
• Maps detection sources (for example tool-abuse-detection) to primary and secondary ASI categories
• Assigns a severity level with a suggested remediation timeline

Install the owasp-asi skill

Download the ZIP for this skill from this page. Unzip it into one of two places: ~/.claude/skills/ to make it available across your projects, or a project's .claude/skills/ folder to limit it to that project.

If you use the Claude apps instead, upload the skill under Settings → Capabilities → Skills.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into .claude/skills/ inside your project
• Claude apps: Settings → Capabilities → Skills, then upload

Trigger the skill with a natural request

The skill's description says it applies when mapping security findings to standardized risk categories. Ask for that task in plain language and include the findings themselves. The skill's own usage note shows it being loaded by name with load_skill(name="owasp-asi"), then applying the mapping rules to classify findings.

Good requests name the taxonomy and give the findings, for example: label these scanner findings with OWASP ASI IDs and severity, or write this audit section referencing the correct OWASP agentic risk IDs.

Example: classify findings into ASI IDs and severity

Suppose a scanner reports an exposed API key in the agent's context, a system prompt that an attacker can read, and a shell command built from unvalidated input. The skill's Finding → ASI Mapping table points API keys and tokens to ASI06, system prompts to ASI01, and command injection to ASI05.

For severity, the skill places an exposed system prompt under High with urgent remediation within 1 week, and remote code execution confirmed under Critical with remediation within 24 hours. Your output should list each finding, its ASI ID, the rationale from the table, and the severity with its timeline.

• API keys, tokens → ASI06 (context contains sensitive data)
• System prompts → ASI01 (enables goal hijacking)
• Command injection → ASI05 (unexpected code execution)

Safety notes: scripts and network

According to the skill's listing, it runs no scripts, uses no network connection and requires nothing else to be installed. It is plain reference material that the agent reads.

Because it does no scanning, it will not confirm that a vulnerability exists. Treat its output as a labeling aid and verify each finding against the original evidence.

• Runs scripts: no
• Uses network: no
• Requires: nothing listed

Tips for consistent labels

Keep the severity timelines as suggestions. The file states they are built in and are not an official OWASP standard for your organization. If your policy sets different timelines, change the rules before using the output in reports.

Pair the skill with a scanner. The detection source table lists skills such as indirect-injection-detection and memory-rag-poisoning-detection, which indicate where a finding came from and help you decide the primary category.

• Record the primary and secondary ASI IDs, not just one
• Check Critical findings against the 24-hour rule in your own process
• Review borderline items such as conditional exploitation paths manually