Skill Constellations: Mapping the Agent Skill Supply Chain on GitHub
Agent skills are SKILL.md files copied between GitHub repositories without a registry, versioning, or provenance. GitSkills reconstructs a dated copy network covering 2,193,119 skill adoptions, showing that stars do not identify the repositories where copies originate. Because downstream copies rarely update after upstream fixes, security patches spread poorly. The study proposes ranking repositories by inferred copying behavior for audit. This approach can block 14.9% of later high-risk adoptions, versus 0.5% from the most starred repositories. It argues for versioned references and provenance-aware auditing to improve agent skill supply chain security.
Key Takeaways
- Agent skills spread across GitHub by file copying, creating a supply chain with no registry, no versioning, and no clear provenance.
- The study reconstructs the first dated copy network of 2,193,119 skill adoptions, revealing how skills propagate and which repositories act as major sources.
- GitHub stars are poor signals for security review: a small number of highly copied repositories drive most adoption, while upstream fixes rarely reach downstream copies.
- An audit ranking based on inferred copying behavior can prioritize high-impact repositories, reducing high-risk adoption by 14.9% compared with 0.5% for the most-starred repositories.
- The work recommends shifting from untracked copies to versioned references and provenance-aware auditing to make agent-skill distribution safer and more maintainable.
Meta description: GitSkills study maps 2,193,119 agent skill copies across GitHub, showing stars miss sources and audit ranks cut 14.9% of high-risk adoptions.
Tags: agent skills, GitHub, GitSkills, software supply chain, Claude Code
Featured image: Abstract technology-style network of linked repository nodes and SKILL.md files, no people, no logos, no text.
Background: Skills Spread Without a Registry
Agent skills are SKILL.md files that give AI coding agents such as Claude Code and Codex instructions and scripts to run under the user's permissions. They package reusable coding logic, so they can speed up development work. But they also create a distribution problem. Sharing usually happens by copying these files from one repository to another.
That pattern produces a software supply chain with no registry, no versions, and no provenance. The origin of a copied skill is unknown. The reach of a security fix is unknown. The repositories that warrant review are unknown. A point-in-time inventory can show where a skill sits, but it cannot reveal who copied it from whom.
Development: A Dated Copy Network Replaces Snapshots
The research introduces the first dated copy network for agent skills. It is reconstructed from the git history of every SKILL.md in GitSkills and spans 2,193,119 skill adoptions across GitHub. The researchers also release an interactive viewer.
The key change is time. Instead of listing current holdings, the network records copying events and their dates. That makes it possible to trace propagation paths and measure how widely a skill has been adopted. Only a small number of repositories account for nearly all copies. GitHub stars do not point to those sources.
The network also shows why fixes are difficult. Copied skills rarely change alongside their upstream source. If a repository patches a risky instruction or script, the copied files do not update automatically. A patch applied upstream therefore rarely reaches copies that have already spread.
Latest Progress: Audit Ranking Cuts High-Risk Adoption
The researchers fit a model of copy sources and use it to rank repositories for audit. The ranking is based on copying behavior inferred from dated history, not on visible popularity.
The difference is large. Reviewing the 100 repositories it ranks highest prevents 14.9% of later adoptions of high-risk skills, compared with 0.5% for the 100 most starred. That gap gives security engineers a short list to inspect before adoption spreads.
The finding reframes the risk question. The most visible repository may not be the most important one to review. The repository that many others copy from may be the one whose contents propagate fastest.
Current Stage: From Untracked Copies to Versioned References
The work moves agent skill security from point-in-time inventory toward provenance-aware auditing. GitSkills, GitHub, Claude Code, and Codex are named parts of the ecosystem, and the study's 2,193,119 adoptions show the scale of copying. The practical implication is that distribution design matters as much as code review.
The study therefore calls for platforms to distribute versioned references rather than copies. That approach would keep downstream users tied to the source and make fixes reachable. The remaining question is whether such versioned references become the normal way agent skills are shared, and whether audit rankings based on copy history become a checkpoint before high-risk skills spread across repositories.
Comments
No comments yet. Be the first to comment.