AI Agent Skills Security (OWASP AST10) Fundamentals Training
A one-day fundamentals programme on OWASP Agentic Skills Top 10 (AST10). Learn how to reduce risks from malicious, over-privileged or poorly maintained AI agent skills. Participants work through practical examples and a guided case before drafting actions for their own organisation.
Who should attend: AI developers, platform owners, security reviewers and teams managing agent skill libraries. No prior framework knowledge is required.
HRD Corp claim support available
Programme Agenda
9:00 AM to 10:00 AM
Skills as a Security Boundary
Define a skill as a reusable package of instructions, metadata and possibly scripts. Introduce AST10 and identify how a skill's source, capabilities and dependencies affect trust.
10:00 AM to 10:15 AM
Break
10:15 AM to 11:30 AM
Malicious Skills and Supply Chains
Recognise untrusted publishers, compromised dependencies and deceptive behaviour. Discuss source verification, pinned versions and integrity evidence rather than assuming popularity establishes safety.
11:30 AM to 12:30 PM
Privileges, Metadata and Instructions
Explore excessive permissions, unsafe metadata and untrusted external instructions. Identify what the runtime should allow and what a package merely claims it needs.
12:30 PM to 1:30 PM
Lunch
1:30 PM to 2:45 PM
Isolation, Scanning and Updates
Compare sandboxing, static checks and behavioural review at an introductory level. Identify limits of scanning and risks from update drift or changing remote content.
2:45 PM to 3:00 PM
Break
3:00 PM to 4:00 PM
Governance and Cross-Platform Reuse
Maintain an approved inventory, accountable owners and audit records. Consider which security assumptions can be lost when a skill is moved between agents or platforms.
4:00 PM to 5:00 PM
Practical Exercise: Approving a New Skill
Review a fictional skill manifest and change request. Identify red flags, propose permission limits and verification evidence, and decide whether to approve, restrict or reject it.
Key Outcomes
- Explain skill-package security risks
- Identify source, privilege and update concerns
- Choose approval and isolation safeguards
- Draft an evidence-based skill review decision
Training Mode Physical / Online / Hybrid
HRD Corp Subject to programme eligibility and HRD Corp approval
Level Fundamentals / Beginner. No prior framework knowledge required.
Duration 1 Day | 9:00 AM to 5:00 PM (6.5 learning hours, excluding breaks)
Venue In-house at the client's premises, or delivered via the client's preferred platform (Microsoft Teams, Zoom, or equivalent)
Assessment Group case exercise and a 10-question knowledge check
Certificate Orbix Certificate of Completion upon full attendance; not a professional certification
Malaysia Relevance
Relevant to specialist Malaysian AI developers and teams approving reusable agent skills. The evolving OWASP AST10 project focuses on skill packages, instructions and dependencies rather than treating all agent risks as the same problem.
Practical Takeaways
An agent skill approval checklist and version-and-permission review record.
Download a sample practice worksheet (TXT). This fictional exercise is a preview of the learning approach. About Orbix; contact us to confirm the facilitator and relevant experience for your delivery.
Course Completion and Next Steps
Participants receive an Orbix Certificate of Completion upon full attendance. This introductory course does not confer professional certification or establish an organisation's compliance. Further implementation and assessment depend on the organisation's scope and obligations.
Frequently Asked Questions
Related Fundamentals Training
AI Agent Protocol Security (OWASP MCP Top 10) Fundamentals AI-Powered Scams & Deepfake Awareness Ransomware Awareness & Prevention Cloud Security (ISO/IEC 27017) Fundamentals View all fundamentals programmes
Reference material: OWASP: Agentic Skills Top 10.