Skill Constellations: Tracing the Supply Chain of Agent Skills on GitHub

Skill Constellations. Tracing the Supply Chain of Agent Skills on GitHub. By Fahd Seddik, from the University of British Columbia, Okanagan. Published on the eighth of October.

Agent skills are SKILL.md instructions and scripts that AI coding agents, such as Claude Code and Codex, run with their user's permissions. Developers share them by copying them from one repository to another. That makes skills a software supply chain with no registry, no versions and no provenance. Nobody knows where a copied skill came from, how far a security fix reaches, or which repositories deserve review. Studies that record which repositories hold a skill at a single moment cannot say who copied it from whom. What now exists, by the author's account for the first time, is a dated copy network of agent skills, released with an interactive viewer.

The network covers about two point two million skill adoptions across GitHub. Its unit is the adoption: one repository taking up a skill. Because it is dated, each copy can be placed in time, so the direction of copying from one repository to another can be traced rather than guessed, and the interactive viewer lets anyone explore those chains directly.

It is built from the git history of every SKILL.md file in GitSkills. That history is what turns a snapshot of who holds a skill into a record of who copied it, and when.

The network already answers some of the open questions. A few repositories are the source of almost all copies, and GitHub stars do not pick them out. Copies almost never change along with their source, so a fix made at the source rarely reaches them. For security engineers, the author fits a model of which repositories others copy from and uses it to rank repositories for audit. Reviewing the top one hundred by that ranking prevents fourteen point nine percent of later adoptions of high-risk skills. Reviewing the one hundred most starred prevents zero point five percent. That gives a short list to check before a skill spreads. For platforms, the recommendation is to distribute versioned references instead of copies.

The value of the record is that it carries time and direction. A count of who holds a skill shows popularity; a dated chain of copies shows origin, and origin is what decides where an audit should start and whether a fix will ever travel downstream.