Skill Constellations: Tracing the Supply Chain of Agent Skills on GitHub

What it claims

Agent skills spread mainly through wholesale catalog copying, not one skill at a time. Copy events account for 33.3% of adoptions and individual adoption for 8.1%, with 58.6% being origins. Spread is extremely concentrated: the top 1% of repositories account for 94.7% of transmissions, with negative-binomial dispersion k = 0.086, so most adoptions transmit to no one.

Stars barely relate to who gets copied (Kendall τ = −0.10 with dated out-degree). Static, undated analysis also misattributes sources: only 7 of the top 20 repositories by static out-degree stay in the top 20 once credited only for skills they held first.

Copies essentially freeze. Only 11.1% of changes within a clone group reach every member, and only 4.0% of genealogies ever change consistently. Just 20.9% of skill copies follow a later source edit, against 47–84% of copied code files adopting upstream security fixes in prior work. Where copies gain command execution, the gain comes from adopting another version of the skill, not from owners' own edits.

How it works

The input is GitSkills (Zenodo DOI 10.5281/zenodo.21875637). The authors keep files named exactly SKILL.md with valid front matter, first committed on or after 1 Oct 2025, in non-fork repositories, and treat each distinct content as one skill. An adoption is dated by its first commit, bounded below by the repository's creation date. A lineage links versions of one skill by edits.

flowchart TD
  A[Commit adds SKILL.md files] --> B{>=10 files and one earlier adopter held >=half its lineages?}
  B -- no --> I[Individual adoption]
  B -- yes --> C{Files in commit}
  C -- under 100 --> D[Bundle copy]
  C -- 100+ --> E[Bulk copy]
  D --> T[Transmission edge if source held lineage first]
  E --> T

The copy-event rule has three conditions: a commit adds 10 or more files, a single earlier adopter held at least half of the commit's existing lineages, and that adopter is credited as the source. The event is a bundle below 100 files and a bulk copy above.

A conditional logit models which earlier adopter a copy event picks as its source. Its inputs are the logs of skills held, past copies, stars and age. The coefficient on past copies is 1.64 for bundles, while attachment to individual skills is sublinear.

Audits are evaluated on a temporal split at 1 April 2026, checked at 1 March and 1 May. Auditing a repository removes its flagged skills plus every downstream copy.

Evidence

• Date validation: in 1,534 folders with installer records, the reconstructed date is within 7 days of the record in 94.6% of cases.
• Finding future sources: ranking before the split, copy out-degree captures 27.8% of later transmissions, against 7.0% for stars. PageRank reaches 27.5%, skills held 29.3%, and the hindsight bound is 43.8%.
• Audits at 100 repositories, as read from Fig. 4b:
• Source-choice model: 14.9%
• Plain copy out-degree: 14.0%
• Ranking by high-risk lineages held: 16.8%
• Stars: 0.5%
• Random: 0.1%
• Hindsight: 26.6%

The text claims only that the model beats stars and random. A simple out-degree or risk-count ranking performs about as well as the fitted model.

• Indirect copies: a quarter of prevented adoptions are indirect copies.
• Timing: a median skill has 7.7% of its eventual adopters by day 7 and half by day 56, so reviewers have weeks.
• Risk flags: precision is 98.3% and recall 80.9% on 200 labelled skills.
• Repository-type labels: Claude Opus 5.5 and Sonnet 5.5 (via claude -p) agree at κ = 0.77, and Opus scores κ = 0.91 against the resolved reference.
• Cross-platform copies: about a third of copies between agent folders now cross platforms. Skills in non-Claude agent folders often name Claude-Code-only tools (56/56 manual checks correct).

How to use it

Code is at github.com/FahdSeddik/Skill-Constellations, the data release is tagged data-v1.0, and the interactive viewer is at fahdseddik.github.io/Skill-Constellations. The page gives no install commands or licence. Its practical guidance:

• Rank repositories for review by current copy out-degree, not stars.
• Act within a skill's first weeks.
• Cover every agent's folder.
• Update the copies you depend on yourself, because upstream fixes won't arrive.

Limits

• Source attribution: the rule names the installer-recorded source in only 26.7% of cases, because it credits the earliest holder of the most lineages, usually a catalog. Source measures describe distribution, not authorship.
• Risk flags: these mark capability, not malice. With 80.9% recall, risk counts are lower bounds.
• Hindsight ceiling: even a hindsight ranking prevents only about a quarter of high-risk adoptions, because roughly half arrive as new skills.
• Coverage: the data cover only the first ten months of the format on public GitHub.
• Community names: the topic names in Fig. 1a are generated by Opus and not validated against human labels.