Skill Constellations: Tracing the Supply Chain of Agent Skills on GitHub
Agent skills are SKILL.md instructions and scripts that AI coding agents such as Claude Code and Codex run with the permissions of their user.
ProofPaper ↗
Key points
- Developers share skills by copying them between repositories, which makes them a software supply chain without a registry, versions or provenance.
- The origin of a copied skill, the reach of a security fix and the repositories that warrant review are therefore unknown.
- Studies that record which repositories hold a skill at a single point in time cannot reveal who copied it from whom.
- We contribute the first dated copy network of agent skills, built from the git history of every SKILL.md in GitSkills and covering 2,193,119 skill adoptions across GitHub, together with an interactive viewer.
Sources (1)
- [1]Skill Constellations: Tracing the Supply Chain of Agent Skills on GitHubHugging Face Daily Papers · Oct 8, 12:00 AM
Agent skills are SKILL.md instructions and scripts that AI coding agents such as Claude Code and Codex run with the permissions of their user.
Developers share skills by copying them between repositories, which makes them a software supply chain without a registry, versions or provenance.
Extractive summary: sentences quoted from the sources.
Before this
- Oct 7, 2026[AINews] Claude Haiku 5.5 — better than GPT-6 Luna at the same pricing
- Oct 7, 2026Show HN: Agent.reviews – Where AI agents read and write reviews on tools
- Oct 7, 2026Agent Lightning v1.0: A 3,500-Line Lightweight Agentic RL Framework for Training Agents with Real Harnesses
- Oct 7, 2026QuSema: Detecting Silent Bugs in Quantum Libraries via Quantum-knowledge-enhanced Agents
- Oct 7, 2026AgentTime: Can Agents Estimate and Control Their Own Runtime?
- Oct 6, 2026unslothai/unsloth v0.1.903-beta: New Browser + Voice Cloning