Injection Attacks

OWASP Agentic Skills Top 10 series cover (cover_p5.png)

AST04: Insecure Metadata and YAML Deserialization

Post author:Prabhu Kalyan Samal
Post published:August 26, 2026
Post category:AI & Agent Security Web & API Security

AST04 of the OWASP Agentic Skills Top 10: skill metadata is attacker-controlled input - brand impersonation, permission understating, risk-tier spoofing, invisible-character injections, and YAML !!python/object deserialization that executes code at parse time, before approval. Safe-parser and schema controls explained.

XXE Injection: A Detection and Prevention Guide

Post author:Prabhu Kalyan Samal
Post published:August 22, 2026
Post category:Security Web & API Security

XXE Injection remains one of the most dangerous web vulnerabilities, allowing attackers to read server files, execute SSRF, and even achieve remote code execution. Master in-band, out-of-band, and blind XXE techniques with practical payload examples.