III. Crosswalks
ATR × OWASP Agentic Skills Top 10
Not an endorsementATR maintainers wrote this mapping. OWASP has not reviewed or endorsed it. It is not evidence of compliance with any regulation.
Sourcedocs/OWASP-AST10-MAPPING.md · last commit 2026-11-10
Generated by
scripts/generate-ast-crosswalk.pyfrom rule metadata; do not edit by hand. The method, the category -> AST join table and its rationale are in crosswalks/atr-ast-crosswalk.md. CI runs--check, so this file cannot fall behind the rules.
OWASP AST10 is a separate framework from the OWASP Top 10 for Agentic Applications (ASI01-ASI10). ASI covers agent runtime threats; AST covers the skill supply chain and lifecycle. Several AST controls are process requirements that a detection rule cannot satisfy.
Rules in corpus at generation time: 844.
Coverage Summary
| OWASP AST Category | Severity | ATR Rules | Status |
|---|---|---|---|
| AST01: Malicious Skills | CRITICAL | 214 rules | STRONG |
| AST02: Supply Chain Compromise | CRITICAL | 58 rules | PARTIAL |
| AST03: Over-Privileged Skills | HIGH | 257 rules | STRONG |
| AST04: Insecure Metadata | HIGH | 123 rules | MODERATE |
| AST05: Untrusted External Instructions | HIGH | 362 rules | STRONG |
| AST06: Weak Isolation | HIGH | 138 rules | STRONG |
| AST07: Update Drift | MEDIUM | 0 rules | GAP (process-level) |
| AST08: Poor Scanning | MEDIUM | 0 rules | GAP (process-level) |
| AST09: No Governance | MEDIUM | 40 rules | MODERATE |
| AST10: Cross-Platform Reuse | MEDIUM | 0 rules | GAP (process-level) |
Status is set by enforce-lane (maturity: stable) rules: STRONG at 20 or more, MODERATE at 5 or more, PARTIAL below that, GAP when no rule maps to the control. It measures how many blocking-grade detections exist for the control's threat surface, not how much of the control is met, and no per-control precision has been measured.
Enforce-lane rules by control
AST01: Malicious Skills (CRITICAL)
214 rules: 21 stable, 164 test, 19 experimental, 10 draft or deprecated.
| ATR Rule | Title | Severity |
|---|---|---|
| ATR-2026-00433 | ModelCache torch.load() Deserialization RCE (CVE-2025-45146) | CRITICAL |
| ATR-2026-00434 | mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514) | CRITICAL |
| ATR-2026-00435 | Azure MCP Server Missing Authentication for Critical Function (CVE-2026-32211) | HIGH |
| ATR-2026-00513 | Package Hallucination Exploitation — AI-Suggested Fake Package Installation | HIGH |
| ATR-2026-00517 | Model Extraction / Distillation Attack via Systematic API Probing | MEDIUM |
| ATR-2026-00714 | Tool Camouflage — Forced Specific Tool Invocation via Injected Instruction | HIGH |
| ATR-2026-00715 | Tool Knowledge Hijack — Identity Injection with Tool Call Arguments | CRITICAL |
| ATR-2026-00720 | Tool Misuse — Privilege Escalation via Social Engineering Agent to Grant Access | MEDIUM |
| ATR-2026-01301 | MCP Tool Description — Exclusive Tool Invocation Override | HIGH |
| ATR-2026-01302 | Fake Tool Result Prefix — Injected Instruction via Simulated Completion | CRITICAL |
| ATR-2026-01303 | Tool Schema Enumeration via Social Engineering | HIGH |
| ATR-2026-01306 | MCP OAuth Authorization URL — Command Injection via URL Authority | CRITICAL |
| ATR-2026-01307 | MCP DNS Rebinding Attack — Hostname Time-Based IP Switching | CRITICAL |
| ATR-2026-01310 | MCP Tool Description — Compliance/Audit Framing for Mandatory Chat Context | CRITICAL |
| ATR-2026-01750 | DoS via Repeat-Word-N-Times Output Amplification | HIGH |
| ATR-2026-01755 | Backdoor Trojan: Linguistic Trigger Phrase (POT Attack) | CRITICAL |
| ATR-2026-01760 | DoS: Forced Infinite / Maximum-Length Output Token Flood | HIGH |
| ATR-2026-01841 | Deepfake of Real Person for Disinformation | HIGH |
| ATR-2026-01896 | Injected Code — Remote-Key Ransomware File Encryption | CRITICAL |
| ATR-2026-01897 | Injected Code — Local Host Sabotage (Filesystem Destruction / Resource Exhaustion / Hosts Tamper) | CRITICAL |
| ATR-2026-01898 | Injected Code — Network Denial of Service (Connection Kill / Adapter Disable / Flood) | HIGH |
AST02: Supply Chain Compromise (CRITICAL)
58 rules: 1 stable, 53 test, 4 experimental, 0 draft or deprecated.
| ATR Rule | Title | Severity |
|---|---|---|
| ATR-2026-01755 | Backdoor Trojan: Linguistic Trigger Phrase (POT Attack) | CRITICAL |
AST03: Over-Privileged Skills (HIGH)
257 rules: 44 stable, 179 test, 30 experimental, 4 draft or deprecated.
| ATR Rule | Title | Severity |
|---|---|---|
| ATR-2026-00702 | Indirect PI — Credential / API Key Exfiltration via Agent Action | CRITICAL |
| ATR-2026-00703 | Indirect PI — Financial Data Exfiltration via Agent Action | CRITICAL |
| ATR-2026-00704 | Indirect PI — Medical / Genetic Data Exfiltration via Agent Action | CRITICAL |
| ATR-2026-00705 | Indirect PI — Location, Address, and Browsing History Exfiltration | HIGH |
| ATR-2026-00706 | Indirect PI — Physical / Biometric Media Exfiltration via Agent | CRITICAL |
| ATR-2026-00707 | Indirect PI — File Exfiltration Combined with Destroy or Tamper | CRITICAL |
| ATR-2026-00708 | Indirect PI — Unauthorized Financial Transfer via Agent Tool | CRITICAL |
| ATR-2026-00709 | Indirect PI — Disable Authentication / MFA via Agent Tool | CRITICAL |
| ATR-2026-00710 | Indirect PI — Unauthorized Physical Access Grant via Smart Lock / Home Automation | CRITICAL |
| ATR-2026-00711 | Indirect PI — System Sabotage via Destructive Shell Command | CRITICAL |
| ATR-2026-00712 | Indirect PI — Malicious Package Installation via Agent (pip/npm) | CRITICAL |
| ATR-2026-00716 | Indirect PI — Data Destruction Instruction via Agent File/Document Tool | HIGH |
| ATR-2026-00718 | Tool Misuse — Autonomous Financial Trading / Crypto Transaction Without Authorization | HIGH |
| ATR-2026-00719 | Tool Misuse — Destructive Bulk Action via Agent (Delete All / Turn Off All) | HIGH |
| ATR-2026-00722 | Indirect PI — Account Manipulation / Emergency Service Dispatch via Pretext | CRITICAL |
| ATR-2026-00850 | Indirect PI — Credential Exfiltration via Email (API Key / Password / Token) | CRITICAL |
| ATR-2026-00851 | Indirect PI — Financial / Payment Credential Exfiltration via Agent Email | CRITICAL |
| ATR-2026-00852 | Indirect PI — Medical Record / Health Data Exfiltration via Agent Email | CRITICAL |
| ATR-2026-00853 | Indirect PI — Genetic / DNA Data Exfiltration via Agent Email | CRITICAL |
| ATR-2026-00855 | Indirect PI — Browsing History / Search History Exfiltration via Agent Email | HIGH |
| ATR-2026-00856 | Indirect PI — Physical Address / PII Exfiltration via Agent Email | HIGH |
| ATR-2026-01450 | SVG onload XSS Injection via Indirect Prompt Injection | HIGH |
| ATR-2026-01453 | Markdown Image Injection with Base64 QUERY Exfiltration Carrier | CRITICAL |
| ATR-2026-01454 | Direct Markdown Image/Link Exfil Payload (attacker.com / evil.com) | CRITICAL |
| ATR-2026-01455 | NEW IMPORTANT INSTRUCTIONS Injection Marker in Document Context | HIGH |
| ATR-2026-01457 | System Prompt Completion and Clone Attack | HIGH |
| ATR-2026-01458 | Compare-Bots Sysprompt Fishing — Role Comparison Extraction | MEDIUM |
| ATR-2026-01459 | Variable-Clone Sysprompt Extraction (ELLA / context-variable Pattern) | HIGH |
| ATR-2026-01460 | JSON Format Sysprompt Extraction — Structured Output Exfil | HIGH |
| ATR-2026-01462 | System Prompt Override via Pseudo-Admin / Authority Injection | CRITICAL |
| ATR-2026-01463 | imend / imstart System Prompt Injection Format Markers | HIGH |
| ATR-2026-01601 | SQL Injection Destructive DDL Statement | CRITICAL |
| ATR-2026-01602 | SQL Injection UNION SELECT Data Exfiltration | CRITICAL |
| ATR-2026-01751 | Indirect Prompt Injection: Fake-Authority Task Abort | HIGH |
| ATR-2026-01752 | Indirect Prompt Injection: CAPTCHA Redirect Task Disruption | HIGH |
| ATR-2026-01753 | Ransom Extortion: Email Exfil + Delete + Wire-Transfer Demand | CRITICAL |
| ATR-2026-01754 | Ransom Extortion: Cloud File Exfil + Delete + Payment Demand | CRITICAL |
| ATR-2026-01890 | Injected Code — Local File Exfiltration to a Remote Endpoint | HIGH |
| ATR-2026-01891 | Injected Code — Live User-Activity / Location / Log Surveillance Exfiltration | HIGH |
| ATR-2026-01892 | Injected Code — Environment-Variable Exfiltration | HIGH |
| ATR-2026-01893 | Injected Code — Host / Hardware Inventory Exfiltration | HIGH |
| ATR-2026-01894 | Injected Code — Browser Cookie / Session-Token Theft | HIGH |
| ATR-2026-01895 | Injected Code — Contact-List Harvest and SMTP Spam Exfiltration | HIGH |
| ATR-2026-01899 | Injected Code — Unauthorized Remote Access (SSH Key Backdoor / Tunnel / Port Forward) | CRITICAL |
AST04: Insecure Metadata (HIGH)
123 rules: 12 stable, 84 test, 17 experimental, 10 draft or deprecated.
| ATR Rule | Title | Severity |
|---|---|---|
| ATR-2026-00434 | mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514) | CRITICAL |
| ATR-2026-00435 | Azure MCP Server Missing Authentication for Critical Function (CVE-2026-32211) | HIGH |
| ATR-2026-00513 | Package Hallucination Exploitation — AI-Suggested Fake Package Installation | HIGH |
| ATR-2026-00714 | Tool Camouflage — Forced Specific Tool Invocation via Injected Instruction | HIGH |
| ATR-2026-00715 | Tool Knowledge Hijack — Identity Injection with Tool Call Arguments | CRITICAL |
| ATR-2026-00720 | Tool Misuse — Privilege Escalation via Social Engineering Agent to Grant Access | MEDIUM |
| ATR-2026-01301 | MCP Tool Description — Exclusive Tool Invocation Override | HIGH |
| ATR-2026-01302 | Fake Tool Result Prefix — Injected Instruction via Simulated Completion | CRITICAL |
| ATR-2026-01303 | Tool Schema Enumeration via Social Engineering | HIGH |
| ATR-2026-01306 | MCP OAuth Authorization URL — Command Injection via URL Authority | CRITICAL |
| ATR-2026-01307 | MCP DNS Rebinding Attack — Hostname Time-Based IP Switching | CRITICAL |
| ATR-2026-01310 | MCP Tool Description — Compliance/Audit Framing for Mandatory Chat Context | CRITICAL |
AST05: Untrusted External Instructions (HIGH)
362 rules: 38 stable, 304 test, 13 experimental, 7 draft or deprecated.
| ATR Rule | Title | Severity |
|---|---|---|
| ATR-2026-00030 | Cross-Agent Attack Detection | CRITICAL |
| ATR-2026-00203 | Context Pollution in Skill Descriptions | HIGH |
| ATR-2026-00432 | SuperAGI Output Handler eval() RCE (CVE-2024-21552) | CRITICAL |
| ATR-2026-00440 | Microsoft Semantic Kernel In-Memory Vector Store eval() RCE (CVE-2026-26030) | CRITICAL |
| ATR-2026-00443 | Word-Fragment Concatenation Assembly Attack | MEDIUM |
| ATR-2026-00446 | Variable-Assignment Payload Injection in User Input | MEDIUM |
| ATR-2026-00452 | Direct PWNED Payload Injection in User Input | MEDIUM |
| ATR-2026-00453 | Secret Key Reveal Demand in User Input | HIGH |
| ATR-2026-00456 | Conditional Empty-Input Payload Injection | MEDIUM |
| ATR-2026-00511 | MCP Web-Fetch Context Poisoning via Embedded Agent Instructions | CRITICAL |
| ATR-2026-00512 | Rules-File Backdoor — Supply Chain Attack on AI Coding Assistant Configuration | CRITICAL |
| ATR-2026-00700 | Indirect PI — Structured-Data Embedded Payload (IMPORTANT!!! Override) | CRITICAL |
| ATR-2026-01000 | Context-Ignore via Fake Completion Prefix | CRITICAL |
| ATR-2026-01001 | Direct Instruction Override Targeting Secret Key / Credentials | HIGH |
| ATR-2026-01002 | Role Escalation via False Authority Claim | HIGH |
| ATR-2026-01005 | Many-Shot Repetition Override via Extended Q&A Chain | HIGH |
| ATR-2026-01006 | Payload-Split String Concatenation Injection | HIGH |
| ATR-2026-01007 | Token-Repeat Flooding Injection | MEDIUM |
| ATR-2026-01009 | Virtual World Bypass: Fictional Scenario for PII/Credential Extraction | HIGH |
| ATR-2026-01012 | Encoding-Evasion: Decode-and-Execute Injection (Morse/ROT13/Hex/Pig-Latin) | HIGH |
| ATR-2026-01013 | Language-Evasion: Multilingual Credential Request | HIGH |
| ATR-2026-01015 | Evasion: Refusal Suppression via Forbidden Response Strings | HIGH |
| ATR-2026-01016 | Evasion: Response Priming via Forced Affirmative Opener | MEDIUM |
| ATR-2026-01017 | Evasion: Dual-Response Split Output (Safe + Unsafe) | HIGH |
| ATR-2026-01019 | System Prompt Override via Fake Diagnostic/Admin Mode | CRITICAL |
| ATR-2026-01020 | Spikee: Document-Embedded Base64 Payload Injection | HIGH |
| ATR-2026-01021 | Spikee: Document-Embedded Translation Covert Channel Injection | HIGH |
| ATR-2026-01023 | Evasion: Opposite-Intent Negation Trick | HIGH |
| ATR-2026-01024 | Evasion: Persona Override as Fictional Rule-Breaker | HIGH |
| ATR-2026-01026 | Evasion: Unicode Glitch Token / Superscript Embedding Anomaly | HIGH |
| ATR-2026-01304 | Indirect Prompt Injection via Data Carrier — IMPORTANT Override | CRITICAL |
| ATR-2026-01757 | Hypothetical-Framing Bypass: Research / Security-Audit Pretext | HIGH |
| ATR-2026-01758 | Hypothetical / Fictional-Story Framing Bypass | HIGH |
| ATR-2026-01759 | DoS Injection: NEW IMPORTANT INSTRUCTIONS Embedded in Document Data | HIGH |
| ATR-2026-01900 | Output Encoding Hijack — Cipher / Base-N / Symbol Substitution of the Response | MEDIUM |
| ATR-2026-01902 | Output Emoji-Substitution Hijack of the Response | MEDIUM |
| ATR-2026-01904 | Injected Hyperlink — Scam / Malware / Advertising URL in the Response | HIGH |
| ATR-2026-01905 | Injected Advertising / Promotional Copy in the Response | MEDIUM |
AST06: Weak Isolation (HIGH)
138 rules: 30 stable, 97 test, 10 experimental, 1 draft or deprecated.
| ATR Rule | Title | Severity |
|---|---|---|
| ATR-2026-00702 | Indirect PI — Credential / API Key Exfiltration via Agent Action | CRITICAL |
| ATR-2026-00703 | Indirect PI — Financial Data Exfiltration via Agent Action | CRITICAL |
| ATR-2026-00704 | Indirect PI — Medical / Genetic Data Exfiltration via Agent Action | CRITICAL |
| ATR-2026-00705 | Indirect PI — Location, Address, and Browsing History Exfiltration | HIGH |
| ATR-2026-00706 | Indirect PI — Physical / Biometric Media Exfiltration via Agent | CRITICAL |
| ATR-2026-00707 | Indirect PI — File Exfiltration Combined with Destroy or Tamper | CRITICAL |
| ATR-2026-00850 | Indirect PI — Credential Exfiltration via Email (API Key / Password / Token) | CRITICAL |
| ATR-2026-00851 | Indirect PI — Financial / Payment Credential Exfiltration via Agent Email | CRITICAL |
| ATR-2026-00852 | Indirect PI — Medical Record / Health Data Exfiltration via Agent Email | CRITICAL |
| ATR-2026-00853 | Indirect PI — Genetic / DNA Data Exfiltration via Agent Email | CRITICAL |
| ATR-2026-00855 | Indirect PI — Browsing History / Search History Exfiltration via Agent Email | HIGH |
| ATR-2026-00856 | Indirect PI — Physical Address / PII Exfiltration via Agent Email | HIGH |
| ATR-2026-01450 | SVG onload XSS Injection via Indirect Prompt Injection | HIGH |
| ATR-2026-01453 | Markdown Image Injection with Base64 QUERY Exfiltration Carrier | CRITICAL |
| ATR-2026-01454 | Direct Markdown Image/Link Exfil Payload (attacker.com / evil.com) | CRITICAL |
| ATR-2026-01455 | NEW IMPORTANT INSTRUCTIONS Injection Marker in Document Context | HIGH |
| ATR-2026-01457 | System Prompt Completion and Clone Attack | HIGH |
| ATR-2026-01458 | Compare-Bots Sysprompt Fishing — Role Comparison Extraction | MEDIUM |
| ATR-2026-01459 | Variable-Clone Sysprompt Extraction (ELLA / context-variable Pattern) | HIGH |
| ATR-2026-01460 | JSON Format Sysprompt Extraction — Structured Output Exfil | HIGH |
| ATR-2026-01462 | System Prompt Override via Pseudo-Admin / Authority Injection | CRITICAL |
| ATR-2026-01463 | imend / imstart System Prompt Injection Format Markers | HIGH |
| ATR-2026-01753 | Ransom Extortion: Email Exfil + Delete + Wire-Transfer Demand | CRITICAL |
| ATR-2026-01754 | Ransom Extortion: Cloud File Exfil + Delete + Payment Demand | CRITICAL |
| ATR-2026-01890 | Injected Code — Local File Exfiltration to a Remote Endpoint | HIGH |
| ATR-2026-01891 | Injected Code — Live User-Activity / Location / Log Surveillance Exfiltration | HIGH |
| ATR-2026-01892 | Injected Code — Environment-Variable Exfiltration | HIGH |
| ATR-2026-01893 | Injected Code — Host / Hardware Inventory Exfiltration | HIGH |
| ATR-2026-01894 | Injected Code — Browser Cookie / Session-Token Theft | HIGH |
| ATR-2026-01895 | Injected Code — Contact-List Harvest and SMTP Spam Exfiltration | HIGH |
AST07: Update Drift (MEDIUM)
No ATR rule maps to this control.
AST08: Poor Scanning (MEDIUM)
No ATR rule maps to this control.
AST09: No Governance (MEDIUM)
40 rules: 11 stable, 26 test, 2 experimental, 1 draft or deprecated.
| ATR Rule | Title | Severity |
|---|---|---|
| ATR-2026-00708 | Indirect PI — Unauthorized Financial Transfer via Agent Tool | CRITICAL |
| ATR-2026-00709 | Indirect PI — Disable Authentication / MFA via Agent Tool | CRITICAL |
| ATR-2026-00710 | Indirect PI — Unauthorized Physical Access Grant via Smart Lock / Home Automation | CRITICAL |
| ATR-2026-00711 | Indirect PI — System Sabotage via Destructive Shell Command | CRITICAL |
| ATR-2026-00712 | Indirect PI — Malicious Package Installation via Agent (pip/npm) | CRITICAL |
| ATR-2026-00716 | Indirect PI — Data Destruction Instruction via Agent File/Document Tool | HIGH |
| ATR-2026-00718 | Tool Misuse — Autonomous Financial Trading / Crypto Transaction Without Authorization | HIGH |
| ATR-2026-00719 | Tool Misuse — Destructive Bulk Action via Agent (Delete All / Turn Off All) | HIGH |
| ATR-2026-00722 | Indirect PI — Account Manipulation / Emergency Service Dispatch via Pretext | CRITICAL |
| ATR-2026-01751 | Indirect Prompt Injection: Fake-Authority Task Abort | HIGH |
| ATR-2026-01752 | Indirect Prompt Injection: CAPTCHA Redirect Task Disruption | HIGH |
AST10: Cross-Platform Reuse (MEDIUM)
No ATR rule maps to this control.
Page generated 2026-11-10Something wrong or missing? Open an issue