OWASP ASI Top 10
February 26, 2026 · View on GitHub
The OWASP Agentic Security Initiative (ASI) Top 10 defines the critical security risks facing AI agent systems. Released in December 2025, it is the emerging standard for evaluating security in autonomous agent frameworks like OpenClaw.
ClawSecure provides comprehensive coverage across all 10 OWASP ASI categories through its 3-Layer Audit Protocol, Watchtower monitoring, and Context-Aware Intelligence.
Coverage Summary
| # | ASI Category | Risk Description | ClawSecure Detection Method |
|---|---|---|---|
| ASI-01 | Agent Goal Hijack | Adversaries manipulate agent objectives through prompt injection or instruction poisoning | Prompt injection detection in SKILL.md files, metadata frontmatter, and bundled script comments. Pattern matching against 55+ known injection techniques. |
| ASI-02 | Tool Misuse | Agents invoke tools in unintended or harmful ways, exceeding granted permissions | Permission analysis auditing system-level tool access requests. Context-Aware Intelligence evaluates whether requested capabilities are appropriate for the skill's stated purpose. |
| ASI-03 | Supply Chain Attacks | Malicious code introduced through skill dependencies, packages, or upstream components | Layer 3 supply chain scanning across npm, PyPI, and bundled packages. Cross-references CVE databases and known malicious package registries. |
| ASI-04 | Unsafe Code Execution | Agents execute arbitrary or unvalidated code on the host system | Static analysis detecting shell command execution, eval patterns, dynamic code generation, and encoded payload delivery. |
| ASI-05 | Rogue Agents | Agents behave outside their intended scope or defy operational constraints | Behavioral fingerprinting and intent classification. Context-Aware Intelligence compares declared functionality against actual code behavior. |
| ASI-06 | Data Exfiltration | Agents transmit sensitive data to unauthorized external endpoints | Network call analysis identifying unauthorized outbound connections, data encoding patterns, and DNS exfiltration techniques. |
| ASI-07 | Inter-Agent Communication | Compromised agents exploit trust relationships in multi-agent workflows | Workflow handshake analysis examining communication patterns between agents in swarm configurations. |
| ASI-08 | Cascading Failures | A compromised component triggers chain reactions across dependent agents and workflows | Dependency chain mapping and supply chain cascade prevention. Identifies single points of failure in agent workflow architectures. |
| ASI-09 | Sensitive Data Exposure | Agents inadvertently expose credentials, tokens, or personal data through logs, config files, or memory | Credential and secret detection scanning config files (~/.openclaw/), environment variables, plaintext API keys, and OAuth tokens. |
| ASI-10 | Agent Persistence | Malicious modifications persist across agent sessions through memory or configuration changes | Watchtower 24/7 hash-drift monitoring. Continuous SHA-256 integrity verification with automatic re-audit on any code change. |
How ClawSecure Maps Findings to OWASP ASI
Every Security Audit Report generated by ClawSecure includes an OWASP ASI Framework Coverage section. Each finding is classified against the relevant ASI category, providing:
- The specific ASI category (ASI-01 through ASI-10)
- Severity rating (Critical, High, Medium, Low, Info)
- A description of the finding in the context of the skill being audited
- Remediation guidance
This mapping allows developers and security teams to assess OpenClaw skills against the same framework used by enterprise security organizations, enabling consistent risk evaluation across the ecosystem.
Context-Aware Intelligence
A key differentiator in ClawSecure's OWASP ASI coverage is Context-Aware Intelligence. Generic scanners apply the same heuristics to all software — flagging standard agent capabilities like file system access, network requests, and shell execution as inherently suspicious.
ClawSecure understands the OpenClaw ecosystem. Capabilities that are normal for an AI agent skill (clipboard access for a productivity tool, network calls for an API integration skill) are evaluated in context rather than flagged blindly. This dramatically reduces false positives while catching genuinely malicious behavior that generic tools miss.
In ClawSecure's audit, 40.6% of all identified vulnerabilities were detectable only through ecosystem-specific analysis. Generic static scanners failed to identify these issues entirely.
Learn More
- OWASP ASI Top 10 Explained for OpenClaw Users — Full guide on the ClawSecure blog
- Scan a skill now — Run a free 3-Layer Audit with OWASP ASI coverage
- Verified Agent Registry — Browse 2,890+ audited skills with OWASP ASI classification