Agent Skills Have Blood Types: A SKILL.md File Copied 2.19 Million Times, and Nobody Knows Who Copied Whom
This morning, while digging through code on my computer, I found a file called SKILL.md. This is not some obscure thing — coding agents like Claude Code and Codex read it and treat it as an operations manual. Developers share skills on GitHub in the plainest way possible: if you like one, copy it into your own repository.
The problem is that, from that moment on, the file becomes yours.
The paper *Skill Constellations: Tracing the Supply Chain of Agent Skills on GitHub* (arXiv:2610.11169, submitted October 8, Fahd Seddik) does something simple: it digs out the git history of every SKILL.md, drawing a timestamped copying network. It covers the git history of all SKILL.md files in GitSkills, spanning all of GitHub — 2,193,119 skill adoptions in total.
The number itself is not astronomical. What really stings are four conclusions.
A Few Source Repositories Account for Almost All Copies
The paper's own words: "A few repositories are the source of almost all copies." Of the 2.19 million adoptions, the vast majority of copies can be traced back to a small number of source repositories.
That is not surprising in itself. Any open-source ecosystem takes this shape: a few projects get forked massively. For human-written software, this is called "influence." For agent skills, it is called an "attack surface."
The difference is the permission level. The abstract makes it clear: agent skills are instructions and scripts that AI coding agents run "with the user's permissions." In other words, every shell command in a SKILL.md executes at the user's own privilege level. Copying a bad skill file is not "depending on a buggy library" — it is "running someone else's commands in my name."
GitHub Stars Are Completely Useless Here
The second finding is blunter: "GitHub stars do not identify them."
Our habit for judging whether an open-source repository is trustworthy is to look at the stars. After measuring, the paper's answer is: for agent skills, star counts are not a valid risk signal.
The reason is easy to guess. Stars are clicked manually by humans, expressing "I want to bookmark this project." Copies are made by tools or scripts, expressing "I need this for this step." The two actions have entirely different motivations, so they statistically decouple.
The paper therefore fits a "who-copied-whom" model, ranks repositories with it, and audits the top 100 ranked repositories. Result: it intercepts 14.9% of subsequent high-risk skill adoptions. Auditing the top 100 repositories by stars intercepts 0.5%.
A 29.8x gap. The same action, with a different criterion for picking repositories, performs nearly 30 times better.
Copies Almost Never Sync with Their Source
The third finding: "Skill copies almost never change with their source."
This is the most classic pitfall in software engineering, called fork drift. In the manual era, merging upstream after forking was a community virtue nobody had patience for, so merges rarely happened — and a security patch landing at the source counted as "released" even though not a single circulating copy received it.
Agent skills accelerate this process. Manually reviewing "does this skill contain suspicious commands" may take tens of minutes; script-based copying takes one commit. Adoption speed is two orders of magnitude faster while review speed is unchanged, so drift is amplified.
The paper's recommendation to platforms is one sentence, but heavy: platforms should distribute versioned references rather than copies. This amounts to admitting that the current distribution method is wrong. The npm ecosystem solved the same problem fifteen years ago with lockfiles and a central registry. The agent skills world doesn't even have that now — the author states it plainly: this is a software supply chain with "no registry, no versions, no provenance."
What This Ecosystem Looks Like Right Now
Piecing the above together:
- A few source repositories supply nearly all copies.
- Star counts (manual bookmarks) are decoupled from actual adoption (scripted copies).
- Copies A, B, C... no longer sync with their sources.
- Copies execute with the user's permissions.
- When the source fixes a vulnerability, it rarely propagates to the copies — there is no parent-child relationship, only a one-way copy from some commit years ago.
- "14.9%" vs "0.5%" are audit effectiveness numbers for this model on this dataset. Whether they hold for a different skill set or time window is not promised by the paper.
- The paper measures "which repositories to prioritize for auditing," not "which skills are malicious." High-risk adoptions are intercepted at 14.9%; whether any of the remaining 85.1% contain genuinely malicious samples is not addressed in the abstract.
- "Copies almost never sync" is a statistical statement. Some frequently-syncing source repositories exist; the abstract gives no exception rate.
- Paper: Fahd Seddik, *Skill Constellations: Tracing the Supply Chain of Agent Skills on GitHub*, arXiv:2610.11169, submitted 2026-10-08 03:25 UTC, 3,773 KB, cs.SE / cs.CR / cs.SI. Pre-print; peer review incomplete.
- All figures (2,193,119 adoptions; 14.9% vs 0.5%; few repositories accounting for nearly all copies; copies almost never syncing with sources; the recommendation to distribute versioned references) are taken verbatim from the arXiv abstract page. The experiments section and tables were not checked item by item.
- The author's affiliation is not listed on the abstract page and was not retrieved.
The abstract's four conclusions, laid out in a table:
| Paper finding | Original wording | Implication | |---|---|---| | Sources are highly concentrated | A few repositories are the source of almost all copies | Audit targets can be narrowed to a few repos | | Stars do not indicate risk | GitHub stars do not identify them | The common practice of picking repos by stars fails | | Copies almost never update | Skill copies almost never change with their source | Fixes at the source rarely reach circulating copies | | Distribute references | distribute versioned references rather than copies | The way out is centralized versioned references, not more copying |
A registry would solve the last row: versions are centrally recorded, and upgrading becomes a pull instead of a copy. The agent skills world has none of this. The author is blunt: it is a software supply chain with "no registry, no versions, no provenance."
What This Research Does Not Say
The paper is a cs.SE + cs.CR + cs.SI cross-listed pre-print; peer review is incomplete. Several limitations are worth stating clearly.
> Tip: The paper ships with an interactive viewer (fahdseddik.github.io/Skill-Constellations/) where you can drag a timeline to watch a given skill file spread across GitHub. The abstract notes the paper also releases the model and data as open source.