Appsec adventures

The OWASP Agentic Skills Top 10 (August 2026 publication) provides the first comprehensive framework for securing agent skill ecosystems—modular bundles of instructions and code that extend AI agent capabilities.  The document identifies ten critical risk categories: Malicious Skills (AST01), Supply Chain Compromise (AST02), Over-Privileged Skills (AST03), Insecure Metadata (AST04), Untrusted External Instructions (AST05), Weak Isolation (AST06), Update Drift (AST07), Poor Scanning (AST08), No Governance (AST09), and Cross-Platform Reuse (AST10). Each risk is documented with real-world evidence including the ClawHavoc campaign (1,184 malicious skills), Snyk's ToxicSkills research (280+ leaky skills), and CVE incidents like ClawJacked and Claude Code vulnerabilities.  The framework provides attack scenarios, preventive mitigations, code examples, and mappings to OWASP AISVS controls, CSA MAESTRO layers, and other industry standards. It emphasizes that skills combine natural-lan...

 Alice and Bob Learn Secure Coding" is a comprehensive guide to secure software development that breaks down complex security concepts into accessible, practical insights for developers of all skill levels. The book covers secure coding practices across multiple programming languages (Python, Java, JavaScript, C/C++, SQL, C#, PHP) and popular frameworks (Angular, Express, React, .Net, Spring), providing readers with a holistic understanding of cybersecurity principles. It explores critical topics including vulnerability prevention, security best practices for various platforms (APIs, mobile, web sockets, serverless, IoT), threat modeling, code review, and the Secure System Development Life Cycle. Using engaging storytelling through the characters Alice and Bob, the book transforms technical security concepts into digestible learning experiences, making it an essential resource for software developers, security engineers, software architects, and application security professionals ...

"Human-Centered Security" is a comprehensive guide designed to help professionals across various disciplines understand and implement effective security strategies that prioritize user experience. The book aims to bridge the gap between technical security measures and human-centric design, providing readers with practical insights into creating security solutions that are both robust and user-friendly. It offers guidance on understanding security impacts, identifying key stakeholders, asking the right questions, and developing adaptive security approaches. The book is particularly valuable for designers, researchers, product managers, and engineers who want to develop security measures that protect users while maintaining a positive and intuitive experience. Key focuses include learning security concepts, understanding user security dynamics, building cross-functional collaboration, and developing strategies to gain leadership support for security initiatives. https://www.ama...