OWASP Agentic Skills Top 10, mapped to BitEvo authority and evidence gates

Exact skill identity and version, the consequential action it can trigger, and the rule that allowed or refused that action.

We test bounded action consequences and evidence gates. Malware reverse engineering is out of scope.

The source and exact artifact version or hash available at decision time, plus the re-approval or blocking rule when that artifact changes.

We test reliance on the installed artifact in the agreed workflow. Registry or platform compromise analysis is out of scope.

The actions and objects the skill is supposed to reach, compared with the permissions and effects it can actually reach.

Core authority scope: whether the granted capability exceeds the written action and object boundary.

Publisher or owner metadata and declared permissions used to authorize the skill, compared with the action surface observed in the workflow.

We test whether metadata is trusted beyond its evidence. We do not operate or certify a signing ecosystem.

Origin, version or retrieval time for external instructions, and whether changed content can authorize an action without renewed validation.

Mutable external instructions are treated as a decision-time evidence dependency; content-security research outside the workflow is out of scope.

The allowed filesystem, network or shell actions and the constrained state reached when an attempted action crosses that boundary.

We validate the agreed control boundary. Sandbox-escape exploit development is out of scope.

The skill version or hash loaded for the decision and the rule that blocks or re-approves execution after version drift.

We test freshness and change handling for the one skill or workflow in scope.

The scanner or review result relied on before effect and which consequential actions remain reachable after that result.

We test a scanner result as an evidence gate for the agreed workflow; this is not a universal scanner benchmark.

Who owns inventory, approval and revocation for the skill, and the constrained state reached after authority is revoked or becomes uncertain.

We test the governance boundary for one agreed workflow or skill, not enterprise-wide governance certification.

The source and target platform permission semantics, the target object actually selected, and any capability drift introduced by the port.

We test one agreed portability case; we do not claim coverage of every agent platform.