The Skills Layer Has a Security Framework Now. It Still Has Three Unsolved Problems.

This post is a synthesis of the Luminity Digital skills layer content library — six published posts spanning the execution architecture, production leakage patterns, strategic ceiling, security surface, and governance vacuum of the agent skills layer — mapped against the OWASP Agentic Skills Top 10, released March 31, 2026. The argument that emerges from that mapping is not additive. It is convergent: three separate lines of analysis, developed independently, pointing to the same structural answer.

On March 31, 2026, the Open Worldwide Application Security Project formally launched the OWASP Agentic Skills Top 10 — the first comprehensive security framework dedicated specifically to the agent skills layer. The release documents ten critical risk categories drawn from confirmed real-world incidents, published CVEs, and a Q1 2026 threat landscape that OWASP describes, without qualification, as already in progress. The AI agent skill ecosystem is under active attack.

For enterprise architects who have been following the Luminity Digital skills series, the OWASP release will feel less like a new finding and more like external confirmation. The skills layer has been the subject of this publication’s most sustained analytical thread — from its first definitional post through the strategic, security, and architectural arguments that followed. What OWASP has now done is add a security classification framework to a set of conditions Luminity has been describing from three other directions since early 2026.

This post completes that mapping. It situates the full Luminity skills corpus against the OWASP framework, names the three distinct problems the skills layer cannot solve itself, and identifies the architectural answer that all three problems point toward.

What the Skills Layer Actually Is

The foundational post in this series defined agent skills precisely: specialized, modular capabilities that enable AI agents to accomplish real-world tasks — not just discuss them. Each skill represents a specific domain of expertise packaged as an executable capability, with embedded best practices, quality standards, and guardrails. Skills are the bridge between AI conversation and AI action — the layer that transforms a capable language model into a system that edits spreadsheets, runs analyses, generates reports, and orchestrates multi-step workflows without a human completing each step manually.

That framing was accurate and remains so. Skills deliver real productivity gains. The question this series has been pursuing — and that OWASP has now joined — is not whether skills are valuable. It is what happens when an organization treats the skills layer as architecturally complete.

A second post in this series examined the production behavior of skill architectures directly, establishing that framework abstractions and skill-based architectures leak in different places and different ways — and that the question for enterprise deployment is not which approach is leak-free, but which leaks can be managed at scale. The post documented why fewer than 10% of framework-based AI pilots reach production: not because the models are incapable, but because the architecture was not designed for production resilience from the start.

The Three Problems

The Luminity skills corpus has developed three distinct and independently supported arguments about what the skills layer cannot solve on its own. They are not variations of the same concern. They operate on different analytical planes — strategic, security, and governance — and they are supported by different bodies of evidence. But they converge on the same structural gap.

Problem 1 — The Strategic Ceiling

The Skills Trap series established the core strategic argument: the skills layer optimizes for execution surface area, not decision intelligence. Models embedded in skills do not persist decision memory, maintain causal representations across time, or store institutional reasoning lineage. Each inference cycle is fundamentally a process of context reconstruction and response synthesis. This architecture is powerful for interpretation and execution. It is not designed to be a decision system of record.

A recent companion post examined Google Cloud’s five ADK skill design patterns — Tool Wrapper, Generator, Reviewer, Inversion, Pipeline — and found that every pattern maps to the execution plane. The Reviewer pattern, which most closely resembles evaluation infrastructure, evaluates whether an artifact meets a predefined specification — execution quality control. It does not evaluate whether the judgment that produced the artifact was sound, or whether the organization is improving its decision quality over time. The execution architecture is complete. The intelligence architecture is absent. The gap between these is not a missing sixth pattern. It is an orthogonal layer of infrastructure.

Problem 2 — The Security Surface

The Consent Gap post named the security condition precisely: in current agentic AI architectures, the user consents to a description. The agent executes code. Nothing in between enforces their correspondence. There is no built-in mechanism to cryptographically verify that a tool’s description matches its behavior. No sandbox enforces the capability boundary declared in the metadata. No runtime confinement prevents a skill from executing beyond its stated scope.

This is not a product defect. It is an architectural inheritance — the application of pre-LLM plugin models to systems where text is both the interface and the attack surface. In traditional software, the OS enforces the boundary between a described permission and an actual system call. In MCP-native agentic architecture, that boundary was never built. The description is executable context. The user’s consent has no technical correlate that validates code-description correspondence.

The Consent Gap post documented four adversary paths that exploit this single structural condition: the malicious skill author who embeds intent at publication, the supply chain attacker who poisons a trusted skill after adoption, the rug pull operator who redefines skill behavior silently post-installation, and the cross-tool shadowing campaign that manipulates a target tool without ever being called. Every adversary type is exploiting the same absence — the missing architectural boundary between what a skill describes and what it executes.

Problem 3 — The Governance Vacuum

The third problem is the one that OWASP AST09 documents most precisely, and it is perhaps the most consequential because it is the most structurally invisible. Most enterprise deployments have no maintained inventory of deployed agent skills, no approval workflow for skill installations, no comprehensive audit logging for agent actions, and no agentic identity controls that distinguish one agent’s actions from another’s. This is not a posture choice. It is the default.

The governance vacuum is not simply a security problem. It is the architectural condition that makes both the strategic ceiling and the security surface worse. Organizations with no skill inventories cannot evaluate decision quality over time — the data that would feed the Decision Intelligence Layer does not exist. Organizations with no approval workflows cannot implement the re-authorization triggers and behavioral monitoring that the Consent Gap analysis identified as minimum viable controls. The governance vacuum is the common substrate that all three problems share.

What OWASP AST10 Confirms

The OWASP Agentic Skills Top 10 is significant not because it discovers new conditions but because it formally classifies conditions that have been accumulating since early 2026. The 10 risk categories — malicious skills (AST01), supply chain compromise (AST02), over-privileged access (AST03), insecure metadata (AST04), unsafe deserialization (AST05), weak isolation (AST06), update drift (AST07), poor scanning (AST08), no governance (AST09), and cross-platform reuse (AST10) — are not theoretical. They are drawn from a documented incident timeline that includes confirmed CVEs, classified malware campaigns, and a public registry poisoning event in which five of the seven most-downloaded skills at peak infection were confirmed malware.

Three of the ten risk categories map directly to the arguments Luminity has been developing:

AST09 (No Governance) is a direct classification of the governance vacuum. OWASP’s mitigations — skill inventories, approval workflows, audit logging, agentic identity controls — are not new recommendations. They are the same controls that the Consent Gap post identified as minimum viable governance for production skill deployments, now formally named and classified by the security community.

AST03 (Over-Privileged Skills) and AST06 (Weak Isolation) together constitute what Palo Alto Networks and Simon Willison named the “lethal trifecta”: a skill that simultaneously holds access to private data, exposure to untrusted content, and ability to communicate externally. OWASP documents that most production deployments satisfy all three conditions. The Consent Gap post named this the structural condition that makes every adversary path viable. The framing differs; the condition is identical.

AST08 (Poor Scanning) confirms the measurement gap that both the skills series and the Consent Gap post have highlighted. OWASP documents that pattern-matching scanners miss the majority of critical threats because the real attack surface is natural-language instruction manipulation rather than code signatures. Organizations measuring execution throughput rather than judgment quality are making the same category error.

What All Three Problems Point To

The three problems are analytically independent. The strategic ceiling emerges from the stateless inference architecture of LLMs — a property of how models work, not how skills are designed. The security surface emerges from the architectural inheritance of pre-LLM plugin models — a property of how the trust boundary was never built. The governance vacuum emerges from the adoption pattern of enterprise AI — a property of how quickly organizations deploy without building the infrastructure to govern what they deploy.

Despite that independence, all three problems share a structural answer: the harness layer. The harness is not a framework abstraction or an orchestration runtime. It is production infrastructure — the layer that sits between the model and the enterprise environment and provides the behavioral constraints, governance substrate, and execution controls that the skills layer, by itself, was never designed to provide.

The connection is not incidental. The Consent Gap post identified five controls required to close the security surface: cryptographic attestation of tool identity, runtime capability confinement, continuous behavioral monitoring, mandatory re-authorization on definition change, and human-in-the-loop gates for consequential actions. Each of these maps directly to harness-layer capabilities. OWASP AST09’s governance mitigations — skill inventories, approval workflows, audit logging, agentic identity controls — are not application-layer recommendations. They are descriptions of what an alignment-grade harness provides as production infrastructure.

The Alignment Gate series and the Harness Engineering series developed this argument in depth: the harness layer is the only structurally viable location for the alignment and governance controls that enterprise AI requires. It is not optional production engineering. It is the architectural precondition for deploying skills safely, governing them durably, and building the Decision Intelligence infrastructure that allows organizational judgment to compound over time.