Skill Constellations: Tracing the Supply Chain of Agent Skills on GitHub
Copied agent skills on GitHub are spreading like an untracked software supply chain.
The paper builds a dated copy network from GitSkills, covering 2,193,119 skill adoptions across GitHub. It finds that a small number of repositories account for most copies, while stars do not reliably identify those sources. Copies rarely update when the source changes, so fixes usually do not propagate. The author says ranking repositories for audit would catch far more later high-risk adoptions than reviewing the most-starred repos.
HF Daily Papers' note
The paper builds a dated copy network from GitSkills, covering 2,193,119 skill adoptions across GitHub. It finds that a small number of repositories account for most copies, while stars do not reliably identify those sources. Copies rarely update when the source changes, so fixes usually do not propagate. The author says ranking repositories for audit would catch far more later high-risk adoptions than reviewing the most-starred repos.
HF Daily Papers' note
score 5