Skill Copy Provenance

Sources#

Skill Constellations: Tracing the Supply Chain of Agent Skills on GitHub

Summary#

An agent skill is a folder holding a SKILL.md and often scripts, and the agent runs it with its user's permissions. Developers share skills by copying the folder into their own repository. There is no registry recording where a copy came from, no version a consumer can pin, and no channel that delivers a fix. Two questions follow for a defender: which repositories to review first, and whether a fix at the source reaches the copies. A snapshot of who holds a skill cannot answer either, because it records the nodes of the spread and not the edges.

Seddik (UBC Okanagan, arXiv 2610.11169, 2026-10-08, empirical, a 5-page short paper with code, data release and an interactive viewer) reconstructs the edges. Working from the git history of every SKILL.md in the GitSkills dataset, he builds the first dated, directed copy network of agent skills: 2,193,119 skill adoptions across GitHub over the format's first ten months. He calls the copy cascade of one skill its constellation. Four findings carry the page:

Spread is concentrated, and popularity does not find it. Repositories copy whole catalogs, not single skills, and the top 1% of repositories account for 94.7% of transmissions. GitHub stars barely correlate with how often a repository is copied from (Kendall τ = −0.10).
Copies do not follow their source. Only 20.9% of skill copies take up a later edit of their source. For copied code files, the cited figure for adopting upstream security fixes is 47–84%.
Copies gain risk by swapping versions, not through their owners' edits. Modified copies add command execution more often than they drop it, and the gain comes from adopting another version of the skill.
Audit targeting by network position works, and stars do not. The 100 repositories a source-choice model ranks highest would, if audited, prevent 14.9% of later high-risk adoptions, against 0.5% for the 100 most starred and 0.1% for 100 random repositories.

The author's prescription is that platforms distribute versioned references rather than copies. The section on the rest of the corpus, below, explains why that is only half the answer.

Evidence note. empirical, single author, no conflict of interest found. Limits to carry with every figure. (1) Source credit means distribution, not authorship. Checked against 1,534 installer-recorded copies, the reconstructed date falls within seven days in 94.6% of cases. The recorded source held the skill earlier in 99.1%, but the rule names that source in only 26.7%, because it credits the earlier adopter holding most of the copied lineages, usually a catalog. (2) Risk flags mark capability, not malice. A skill is flagged for bundling executables, pre-approving tools or instructing risky actions; the strict flag has 98.3% precision and 80.9% recall on 200 labelled skills, so risk counts are lower bounds. (3) Public GitHub, first ten months only, non-fork repositories, files first committed from 2025-10-01. (4) Model labels. Repository types and skill risks were labelled by Claude Opus 5.5 after it reached κ = 0.91 against a reference built from Opus and Sonnet 5.5 agreement plus manual resolution. The author notes this reference favours Opus. (5) The headline 14.9% / 0.5% is stated in the abstract and Fig. 4. Every other per-panel value on this page was read from the figure images. The figures are raster in the raw and docling recovered no panel values.

How the network is built#

Population. GitSkills (released July 2026, archived on Zenodo): files named exactly SKILL.md with valid front matter, first committed on or after 2025-10-01, in non-fork repositories. Each distinct content is one skill. An adoption is a repository acquiring a skill, dated by its first commit and bounded below by the repository's creation date, since forks and mirrors carry older history.
Copies. A commit that adds ten or more SKILL.md files is a copy event when one earlier adopter held at least half of its existing lineages. That adopter is the source. Below 100 files it is a bundle, above it a bulk copy. A lineage in a copy event that the source held first is a transmission. Every other adoption is individual. A lineage links the versions of one skill that are joined by edits.
Model and audits. A conditional logit predicts which earlier adopter a copy event picks as its source, from log skills held, past copies, stars and age. Audits are scored on a temporal split (main split 2026-04-01, checked at 03-01 and 05-01). Each strategy ranks repositories on training-period data only, and auditing a repository removes its flagged skills, which prevents its held-out high-risk adoptions and every copy that descends from them. A weekly simulation calibrated on the pre-split weeks reproduces the ordering independently.

RQ1–RQ2: where spread comes from#

64.2% of repositories share no skill with any other. The rest form 50 topic-organised communities of at least 100 repositories each (Fig. 1a). One skill, web-design-guidelines, reached 972 adopters over 12 generations of copies (Fig. 1b).
Copying outweighs individual adoption, 33.3% to 8.1% of adoptions. The remaining 58.6% are origins (Fig. 2a). Preferential attachment works on catalogs: a bundle copy favours a source that has already been copied (coefficient 1.64 on log past copies), while attachment to individual skills is sublinear, under all nine threshold settings of the copy-event rule.
Transmission is highly overdispersed (negative-binomial k = 0.086). Most adoptions pass the skill to nobody, and the top 1% of repositories carry 94.7% of transmissions (Fig. 2b–c).
Stars are not the signal. τ = −0.10 between stars and dated out-degree (Fig. 2d). Ranked before 2026-04-01, current copy out-degree captures 27.8% of later transmissions against 7.0% for stars, the 4.0× in the prose. Skills held (29.3%) and PageRank (27.5%) do about as well, and a hindsight bound reaches 43.8% (Fig. 2e). Among the 1,457 unstarred top sources, 66.4% are ordinary projects, not aggregator catalogs (Fig. 2f). Stars are also manipulable: the paper cites a fake-star study.
Dating corrects attribution. Only 7 of the 20 repositories with the highest static out-degree stay in the top 20 once credited only for skills they held first. The rest are late adopters that a snapshot mistakes for sources.

RQ3: copies do not move with their source#

Consistent change is rare. Take a clone group, the repositories holding one exact version in a week. Only 11.1% of changes to a group move every member to the same next version, at every observation window (Fig. 3a). Consistency collapses once a group spans several owners (Fig. 3b), and a single owner raises the odds of a consistent change 3.32-fold controlling for size, platform and content (Fig. 3c). Only 4.0% of genealogies ever change consistently (Fig. 3d).
The follow rate is 20.9%, and a snapshot would say 6.3%. In a snapshot an updated copy is indistinguishable from a fresh copy of the new version, so snapshot methods understate how often copies follow a source edit, here 3.3-fold (Fig. 3g). By owner: 51.6% of same-owner copies follow, against 17.2% across owners. Most of what propagation exists is one owner syncing their own repositories.
Risk arrives by version swap. Among modified copies, command execution is added in 3.5% and removed in 1.2% (Fig. 3e). Owners' own edits add and remove capabilities about equally. The net gain comes from adopting another version of the skill (Fig. 3f). Against the exact version copied, most security-sensitive lines that adaptations add replace content of the same kind.
Flagged skills spread less than chance. They reach fewer repositories than a uniform permutation null predicts (28.6% against 41.1%).
Copies cross agents unadapted. Skills in other agents' folders often name tools only Claude Code provides: 23.2% of .codex skills, 14.7% of .cursor, 14.1% of .agents, 7.1% of .github, against 2.6% of .claude skills naming another agent's tools (Fig. 3h; all 56 manually checked cases correct).

RQ4: whom to audit, and how fast#

The headline. Auditing the model's top 100 prevents 14.9% of held-out high-risk adoptions, the 100 most starred 0.5%, 100 random 0.1% (Fig. 4a–b). The ordering holds at the March and May splits and under the lenient flag. A quarter of prevented adoptions are indirect copies.
What the abstract leaves out. The same panel (Fig. 4b, 1 April split) shows two simpler rankings beside the model: repositories ranked by high-risk lineages held reach 16.8%, above the model, and copy out-degree reaches 14.0%. The paper's claim is that network position beats popularity, and the figure supports exactly that. It does not show the fitted model beating a count of risky holdings, and the conclusion's own advice is to rank by current copy out-degree. For a defender, the cheap rankings are the result.
The ceiling is low. Even a hindsight-chosen ranking prevents only 26.6%, because roughly half of later high-risk adoptions arrive as new skills that no audit of existing sources could have seen.
Reviewers have weeks. A new skill reaches 7.7% of its eventual adopters by day 7 and half by day 56 (median lineage, Fig. 4c).
Review must cover every agent. Cross-platform copies between agent folders rose from near zero in November 2025 to a 40.2% peak in March 2026, and stood at 34.6% in July 2026 (Fig. 4d).

Reading it against the rest of the corpus#

Against Gao et al. on Agentic Work Systematization (consistent, with a method qualification). Gao et al. found reuse is a near-verbatim copy and 53% of reused skills are never modified. Seddik calls that "in line with our measurement." The new finding is that snapshot-style follow measures undercount the copies that did take a source edit, 3.3-fold here. The direction of Gao's lifecycle result stands. Its "no update channel" reading becomes "a weak, mostly same-owner channel": 20.9% overall, 17.2% across owners.
Against the marketplace time-of-check/time-of-use on Write-Then-Trusted and Agent Supply Chain Risk (a tension, resolved by pinning). The low follow rate cuts both ways. A source that turns malicious after adoption, as the Zenity family did on 2026-07-11, reaches roughly one existing copy in five by the same mechanism that keeps fixes from landing. Versioned references, the paper's prescription, would deliver the fix to everyone and also deliver the turn to everyone. Both findings hold if the reference is pinned to a digest and moved deliberately, which is the resolved-manifest-with-digests remedy Kapner et al. ask for MCP servers. My synthesis, not the paper's. The paper does not discuss malicious updates at a source.
Against Harness Configuration Defects (consistent). Kapner et al. found setups from community recommendation lists no cleaner than the rest (18.9% vs 18.4% confirmed defects). Seddik finds stars do not identify sources. Both say the visible popularity signal is not a security signal.
Against Human-Governed Skill Maintenance (scope). Shen & Hruschka measure maintenance at five vendor repositories, exactly the kind of source others copy from. At a 20.9% follow rate, most of that maintenance never reaches the copies in circulation.
Against Agent Self-Poisoning (the CREATE-Path) (different mechanism). EvoMal's library amplifies a planted skill 4.9–9.0× because the agent writes new copies. Here humans copy, and flagged skills spread less than chance. The two do not conflict. They measure different copiers.

Connections#

Agent Supply Chain Risk — the threat catalogue this page gives a population map for. Skills are the layer of that catalogue with no lockfile at all, and this is the first measurement of who distributes them.
Write-Then-Trusted — "checked once, trusted forever" at population scale. The 20.9% follow rate puts a number on how rarely a re-check reaches a copy, and the same number bounds how far a post-adoption turn spreads.
Agentic Work Systematization — Gao et al.'s lifecycle, which this page dates and partly corrects for method.
Harness Configuration Defects — the other public-GitHub census of installed agent configuration. It counts defects per setup; this page counts who copied them from whom.
Human-Governed Skill Maintenance — maintenance at the sources, which mostly does not propagate.
Agent Self-Poisoning (the CREATE-Path) — agent-authored copies, the self-amplifying counterpart to human copying.
Agent Context Files — the skill format and its progressive-disclosure convention. The cross-agent finding (Codex folders naming Claude Code tools) is a portability defect in that format.
Claude Code — the agent whose tools other agents' skill folders most often name.

Open Questions#

Does a ranking by high-risk lineages held (16.8% at 100 audits in Fig. 4b) beat the fitted source-choice model (14.9%) at the March and May splits and under the lenient flag, or only at the 1 April split? The released data-v1.0 network makes this a rerun. If the simple count wins throughout, the actionable result is "audit whoever holds the most flagged lineages," and the model's added value is explaining spread, not targeting audits.
When a skill source changes after adoption, does the change reach copies at the same 20.9% rate when it adds a risk capability as when it removes one? The paper measures follow rate over all edits and capability change over copies, never their join. The answer decides whether the copy model protects against a post-adoption turn like the Zenity family's or only fails to deliver fixes.
Would a digest-pinned skill reference, moved only by an explicit update, raise the cross-owner follow rate for fixes above 17.2% without carrying malicious turns automatically? Falsifiable once any agent or registry ships pinned skill references, by comparing follow rates before and after.

Sources#

Skill Constellations: Tracing the Supply Chain of Agent Skills on GitHub — Fahd Seddik (University of British Columbia, Okanagan), Skill Constellations: Tracing the Supply Chain of Agent Skills on GitHub, arXiv 2610.11169, 2026-10-08, empirical, 5pp short paper. Cited for: abstract (2,193,119 adoptions; 14.9% vs 0.5%); §II (population, copy-event rule, conditional-logit source-choice model, temporal-split audits, installer validation 94.6% / 99.1% / 26.7%, flag precision 98.3% / recall 80.9%, LLM labelling and κ values); §III-A–D and Figs. 1–4. Parse warning: Figs. 1–4 are raster charts and docling recovered none of their panel values. Every per-panel value here was read from the figure images, and the Fig. 4b values were confirmed against pdftotext -layout of the local PDF (page 4), whose embedded text layer holds the panel labels. The raw has no tables.