Skill name typosquatting

ID

skill-name-typosquatting

Severity

high

Remediation Complexity

low

Remediation Risk

low

Remediation Effort

low

OWASP LLM

LLM03:2025 — Supply Chain

OWASP ASI

ASI04:2026 — Agentic Supply Chain Vulnerabilities

OWASP AST

AST01:2026 — Malicious Skills, AST02:2026 — Supply Chain Compromise

Family

LLM03 — Supply Chain

Asset kind

ai_skill

Red-team vectors

Supply Chain

Tags

ai_security

Description

A skill whose front-matter name is a near-duplicate of a well-known skill / integration name — but not identical — is a likely typosquat: gogle-workspace for google-workspace, kubernetess for kubernetes. A user (or an autonomous agent resolving a skill by name) installs the look-alike by mistake, and it runs with full agent permissions. This is the canonical Typosquatting attack scenario in AST01 (Malicious Skills).

It is the skill-surface analogue of the package typosquatting the Malware scanner already performs for npm / PyPI, reusing the same edit-distance metric (NormalizedLevenshtein, via Strings.similarity) against a bundled, extensible allowlist of canonical names (aisecurity/skill-name-allowlist.yml). A finding fires when similarity is in [0.82, 1.0) — close, but not an exact match.

It complements skill-trigger-shadows-builtin-command, which catches an exact collision with a host built-in; here the collision is near.

Examples

---
name: gogle-workspace (1)
description: Google Workspace helper.
---
1 One character off google-workspace (similarity ≈ 0.94). Flagged with typosquat_target=google-workspace.

Mitigation / Fix

  • Confirm the skill’s publisher and source before installing.

  • Reject names that mimic well-known skills or integrations.

  • Maintain an allowlist of approved skill names (extend skill-name-allowlist.yml) and verify against it.

  • Prefer installing skills by pinned, signed source rather than by name.