Skill Constellations: Tracing the Supply Chain of Agent Skills on GitHub
Auditing the 100 right repositories stops 30x more risky agent-skill copies than auditing the 100 most-starred ones.
A new arXiv paper maps how 'agent skills'—instructions and scripts run by coding agents like Claude Code and Codex—spread across GitHub by direct copying rather than through any registry or versioning system. The authors built a dataset of over 2.19 million skill adoptions and found that a small, non-obvious set of source repositories accounts for almost all copies, that fixes rarely propagate to copies, and that targeted auditing of their ranked top 100 repos prevents far more high-risk adoptions than auditing the most-starred ones.
Why it matters
Agent skills are shared like code but lack package-manager basics: no registry, no versioning, no provenance tracking. This research shows that popularity metrics are useless for finding the actual choke points in this informal supply chain, and that a fix published upstream mostly fails to reach the repositories that copied the vulnerable version, which is a structural security gap as agent skills proliferate.
What is verified
The study built a dated copy network of agent skills from git history covering 2,193,119 skill adoptions across GitHub in a dataset called GitSkills. [1]
The research found that a small number of repositories are the source of almost all copies, and GitHub star counts do not identify these source repositories. [1]
Skill copies almost never update when their source changes, meaning a security fix at the source rarely propagates to copies. [1]
Auditing the top 100 repositories ranked by the study's model prevented 14.9% of later adoptions of high-risk skills, compared to 0.5% when auditing the 100 most-starred repositories. [1]
The paper recommends that platforms distribute versioned references to skills rather than copies. [1]
What is not
- No information on whether GitHub, Anthropic or OpenAI plan to adopt the versioned-reference recommendation.
- The paper does not specify what counts as a 'high-risk skill' in concrete terms or give examples of actual exploited skills.
- No independent verification or peer review of the methodology is mentioned beyond the arXiv submission.
- Unclear how actionable the audit ranking model is for teams without access to the full GitSkills dataset or tooling.
Sources
- 1arXiv cs.CRarxiv.org · Primary source
Original source published 8 October 2026 at 05:25.
An AI-assisted briefing by Coding Partners. We link the evidence behind the reporting so you can explore the original work and assess the claims. How CP Signal works.