Agent skills on GitHub form a hard to track copy network
Skill Constellations: Tracing the Supply Chain of Agent Skills on GitHub
Software EngineeringCryptography and SecuritySocial and Information Networks
Summary
Software skills that AI coding agents use are copied between GitHub repositories, but this copying happens without clear version control or tracking who copied from whom. The authors studied over two million cases of copying from git history to map how these skills spread. They found that just a few repositories are the main sources of most copied skills, and fixes in these sources rarely reach the copies. They created a way to rank repositories for security review that helps prevent the spread of risky skills better than simply looking at popular repositories.
What this means in practice
- •For security engineers: Inspect a short ranked list of repositories to block the spread of high-risk agent skills before they propagate widely.
- •For platform developers: Improve skill sharing by creating versioned references to skills instead of copying, making updates and fixes propagate correctly.
Authors
Fahd Seddik
Abstract
Agent skills are SKILL.md instructions and scripts that AI coding agents such as Claude Code and Codex run with the permissions of their user. Developers share skills by copying them between repositories, which makes them a software supply chain without a registry, versions or provenance. The origin of a copied skill, the reach of a security fix and the repositories that warrant review are therefore unknown. Studies that record which repositories hold a skill at a single point in time cannot reveal who copied it from whom. We contribute the first dated copy network of agent skills, built from the git history of every SKILL.md in GitSkills and covering 2,193,119 skill adoptions across GitHub, together with an interactive viewer. A few repositories are the source of almost all copies, and GitHub stars do not identify them. Skill copies almost never change with their source, and a fix at the source therefore rarely reaches them. We fit a model of which repositories others copy from and use it to rank repositories for audit. Reviewing the 100 repositories it ranks highest prevents 14.9% of later adoptions of high-risk skills, against 0.5% for the 100 most starred, which gives security engineers a short list to check before a skill spreads. Platforms should therefore distribute versioned references rather than copies. Project Website: https://fahdseddik.github.io/Skill-Constellations/