Skill Constellations: Tracing the Supply Chain of Agent Skills on GitHub

Key points

• Developers share skills by copying them between repositories, which makes them a software supply chain without a registry, versions or provenance.1
• The origin of a copied skill, the reach of a security fix and the repositories that warrant review are therefore unknown.1
• Studies that record which repositories hold a skill at a single point in time cannot reveal who copied it from whom.1
• We contribute the first dated copy network of agent skills, built from the git history of every SKILL.md in GitSkills and covering 2,193,119 skill adoptions across GitHub, together with an interactive viewer.1

Sources (1)

• [1]Skill Constellations: Tracing the Supply Chain of Agent Skills on GitHub
  Hugging Face Daily Papers · Oct 8, 12:00 AM

  Agent skills are SKILL.md instructions and scripts that AI coding agents such as Claude Code and Codex run with the permissions of their user.

  Developers share skills by copying them between repositories, which makes them a software supply chain without a registry, versions or provenance.

Extractive summary: sentences quoted from the sources.