Study reconstructs the replication supply chain network of Agent skills on GitHub

Core problem: AI coding agent skills are distributed through cross-repository copying, forming a software supply chain lacking dependency graphs, version control, and source tracing mechanisms, leaving security teams unable to determine fix propagation scope and priority audit targets.

• Scenario and importance: Coding agents (such as Claude Code, Codex, Cursor) extend functionality through skills containing SKILL.md instructions and scripts; skills hold users' execution permissions, can run shell commands, access the network, and modify files. The authors state that within ten months, the format appeared in 259,596 repositories, containing 1,612,846 distinct skills.
• Gaps in existing research: Previous studies analyzed skills primarily at a single temporal snapshot, or focused on individual or pairwise skills, only recording which repositories contained skills at a given moment, without knowing the order of acquisition, copy relationships, or timing across repositories.
• Core observation and hypothesis: The GitSkills dataset shows that half of SKILL.md files on GitHub are verbatim copies. The authors argue that snapshots can only capture nodes in the skill copy network (constellation); only the full git commit history can restore the directed edges in the diffusion process.
• Paper's solution: By mining the git history of all SKILL.md files in GitSkills, the authors constructed what they claim is the first timestamped directed copy network of skills (containing 2,193,119 adoption events) and proposed a copy source selection model to guide security audits.

Agent skills and context file analysis

• GitSkills (Destefanis et al., 2027) and clone detection (Zhu et al., 2026): GitSkills reports that half of the files are verbatim copies, and Zhu et al. used multimodal clone detection to find similar skill pairs; the authors note that neither work shows who copied from whom or how modifications propagated.
• Gao et al. (2026): found that 53% of reused skills in the registry were never modified, and the authors say this conclusion matches their measurements.
• Developer interaction and prompt injection research: Li et al. (2026), Mohsenimofidi et al. (2026), and Jiang and Nam (2026) studied how developers use agents, AGENTS.md, and Cursor rules; Zhao et al. (2026) and Zhang et al. (2026) studied how injected instructions propagate across MCP tools and agent frameworks; the authors note that no prior work has measured skill propagation across codebases.

Code cloning, forking, and dependency networks

• Copy-based code reuse research: Jahanshahi et al. (2026) report that only 2.43% of copy-based reuse can be identified by dependency analysis; He et al. (2026) studied implicit dependencies in file-level copying and report that upstream security fixes are adopted at rates between 47% and 84%.
• Fork synchronization and clone evolution: Zhu et al. (2026) note that software forks rarely contribute changes back to the main branch; Sousa et al. (2026) tracked clone lineages within a single project; Park et al. (2026) and Zhao et al. (2026) studied package replication and code poisoning.
• Vulnerability tracking in dependency networks: Robinson et al. (2026) tracked vulnerability propagation in JavaScript dependency networks through explicitly declared dependencies; the authors note that the skills ecosystem lacks explicit dependency declarations.

Baseline methods and datasets

• Baseline methods: In evaluating audit ranking and propagation source identification, the paper compares against GitHub stars, PageRank, skills held, current copy out-degree, and high-risk lineages held, and contrasts with a hindsight bound and random ranking.
• Dataset: Uses the GitSkills dataset archived on Zenodo (Destefanis et al., 2027).

The authors position this paper as a study of reconstructing skill copy networks from git commit history; prior security work focused on detecting dangerous skills, while this paper builds a source selection model to rank codebases for review.

The authors extracted the complete git commit history of all SKILL.md files in GitSkills, reconstructed a timestamped directed copy network, and built a conditional logit model to evaluate audit intervention strategies.

Data filtering and adoption timing

• Data source and filtering rules: Used the GitSkills dataset released in July 2026, filtering repository files whose filename is exactly SKILL.md, with valid front matter, first commit time on or after October 1, 2025, and not from a fork; each distinct file content is treated as a separate skill.
• Adoption and timing: Extracted the full git commit history of the SKILL.md path from each default branch clone. A repository acquiring a skill is called an adoption; adoption time is determined by the first commit time of that file, with the lower bound set to the repository creation time to exclude temporal biases carried by forks and mirror repositories.

Lineage, copy events, and skill constellation construction

• Lineage: Different versions of a single skill are linked into a lineage through edit relationships; the first adoption of that lineage is its origin.
• Copy Event: When a commit adds 10 or more SKILL.md files, and a single earlier adopter holds at least half of the existing lineages, it is judged to constitute a copy event, and that earlier adopter is identified as the copy source.
• Copy scale classification: Adding between 10 and 99 files is classified as a bundle copy; reaching 100 or more is classified as a bulk copy.
• Propagation and Constellation: If the origin of a lineage in a copy event is the copy source itself, the adoption of that lineage is recorded as a transmission; other adoptions are recorded as individual adoptions. The diffusion cascade network of a single skill composed of all its copies is the skill's constellation, with adopters as nodes and transmissions as timestamped directed edges.

Propagation modeling and audit recommendation strategy

• Source selection model: A conditional logit model is used, modeling which earlier adopter a copy event selects as its source, based on the log of the number of skills held by candidate source repositories, the log of the number of times they have been copied historically, the log of GitHub stars, and the log of repository age.
• Dynamic simulation: Weekly simulations increase individual adoptions proportionally to a power law of current adopter count, calibrated using weekly data before April 1, 2026.
• Temporal split audit evaluation: Before the temporal split point, only training-period historical data is used; repositories are ranked by scores from the source selection model (or baselines such as stars or out-degree); auditing a repository removes all its flagged skills, thereby blocking that repository's high-risk adoptions and all subsequent derived copies in the held-out test period.

Risk labeling and model annotation validation

• Risk labeling rules: Flag skills that bundle executables, pre-approve tools, or instruct risky operations.
• LLM annotation and consistency protocol: Claude Opus 5.5 and Claude Sonnet 5.5 independently annotated 3 risk items for a random sample of 150 source repository types and a stratified sample of 200 skills; models were run via the Claude Code command-line interface (claude -p), following written specifications and citing the original lines that determined their answers.
• Repository classification and human adjudication: Repositories were classified into 5 categories: aggregation directories, starter templates, self-replicating owners, bot-generated or collaborative repositories, and ordinary projects; the unweighted Cohen's κ between the two models for repository type was 0.77, and for skill issues κ ranged from 0.66 to 1.00; disagreements were resolved by humans as a reference standard, with Opus achieving κ = 0.91 on repository type. Strict risk labeling achieved 98.3% precision and 80.9% recall on the 200 skills.

Experimental setup

• Data scale and scope: Used the GitSkills dataset, covering SKILL.md files with first commit on or after October 1, 2025, including 259,596 repositories, 1,612,846 distinct skills, and 2,193,119 skill adoption events.
• Baseline strategies: The audit experiment compared GitHub stars, current copy out-degree, skills held, high-risk lineages held, PageRank, random auditing, and a hindsight bound.
• Evaluation metrics: High-risk adoptions prevented %, later transmissions captured %, consistent changes %, and follow rate %.
• Annotation and review models: Used Claude Opus 5.5 and Claude Sonnet 5.5 (via claude -p) for type annotation on a sample of 150 source repositories and three risk annotations on a sample of 200 skills, with human adjudication of 18 repository and 28 skill disagreements as a reference standard; Opus annotated the remaining 1,507 source repositories after meeting a 95% bootstrap interval lower bound exceeding the 0.6 threshold.
• Validation sample size: Algorithm validation used 1,534 skill installer directories with recorded copy source and time.

Main results

• Source selection model performance: The authors note that the source selection model prevented 14.9% of high-risk adoptions under the 1 April 2026 split, higher than GitHub stars (0.5%) and random strategy (0.1%), and the ranking remained consistent under the March 1 and May 1 splits.
• Direct and indirect blocking: The authors state that one quarter of prevented high-risk adoptions were indirect copies.
• Hindsight bound explanation: Even the hindsight-selected upper bound could only prevent 26.6%, which the authors attribute to about half of high-risk adoptions appearing as new skills that cannot be blocked through historical sources.

Copy source characteristics and star distortion analysis

• What was measured: Correlation between GitHub stars and copy network out-degree (Figure 2d), and the ability of stars and network metrics to identify future propagation sources (Figures 2e, 2f).
• Results: Kendall τ between GitHub stars and timestamped out-degree was -0.10 (Figure 2d); under the 1 April 2026 split, current copy out-degree captured 27.8% of later transmissions, while stars captured only 7.0% (Figure 2e); among 1,457 unstarred top sources, 66.4% were ordinary projects (Figure 2f); of the top 20 repositories by static out-degree, only 7 remained in the top 20 after correcting temporal attribution (Section III-B).
• Author interpretation: The authors state that GitHub stars provide almost no out-degree information and are susceptible to star-buying manipulation; static snapshots cause attribution errors, mistaking late adopters for sources.

Copy evolution and capability change analysis

• What was measured: Consistent change rates of clone groups across different time windows (Figures 3a, 3b, 3c), and the direction of functional additions or removals in modified copies (Figures 3e, 3f).
• Results: The proportion of consistent changes in clone groups remained around 11.1% across all observation week windows (1 week 11.1%, 10 weeks 11.6%, Figure 3a); only 4.0% of lineages ever had consistent changes (Figure 3d); single ownership increased the odds of consistent changes by 3.32 times (Figure 3c); modified copies increased command execution proportion (3.5%) more than they removed it (1.2%) (Figure 3e), and net capability increases mainly came from adopting other versions rather than self-modification (Figure 3f).
• Author interpretation: The authors note that skill copies rarely update with their sources, making upstream security fixes difficult to propagate to downstream copies; copies gaining high-risk permissions mainly result from introducing other existing versions.

Cross-platform propagation and defense response window

• What was measured: Proportion and evolution of cross-agent-platform copying (Figures 3h, 4d), and the temporal arrival curve of skill diffusion (Figure 4c).
• Results: Cross-platform copy proportion rose from 27.9% in November 2025 to 40.2% in March 2026, and was 34.6% in July 2026 (Figure 4d); under other agent directories, .codex directories had 23.2%, .cursor 14.7%, and .agents 14.1% of skills directly naming tools or files provided only by Claude Code (Figure 3h); new skills reached only 7.7% of their eventual adopters by day 7, with a median of 56 days to reach half (Figure 4c).
• Author interpretation: The authors believe cross-platform copying occurs without adaptation, so security review must cover all agent platforms; since skill diffusion takes weeks, reviewers have a response window of several weeks.

Other ablations and analyses

• Propagation overdispersion: Negative binomial dispersion parameter k = 0.086 (Figure 2b)
• Top repository concentration: The top 1% of repositories accounted for 94.7% of all transmissions (Figure 2c)
• Adoption type distribution: Original origins 58.6%, copies 33.3%, individual adoptions 8.1% (Figure 2a)
• Snapshot omission estimate: Snapshot-measured follow rate (6.3%) was 3.3 times lower than temporal history (20.9%) (Figure 3g)
• Reconstruction time validation: Among 1,534 installer records, reconstructed times matched records within 7 days in 94.6% of cases (Section II)
• Strict risk labeling performance: 98.3% precision and 80.9% recall on 200 sampled skills (Section II)

Negative results and exceptions

• Limitations of source attribution rules: Among 1,534 installer records, the authors' rules identified the recorded actual source in only 26.7% of cases, because the rules assign attribution to the earlier adopter holding the most lineages (usually aggregation directories), indicating that source-level measurements describe distribution channels rather than initial authors (Section II).
• Diffusion scope of flagged skills: Flagged high-risk skills actually reached a lower proportion of repositories than predicted by a uniform permutation null hypothesis (actual 28.6% vs. predicted 41.1%) (Section III-C).

作者指出的局限与后续方向

• 分发源而非创作者归属：审计评估仅依赖于哪些代码库是复制源，而不依赖于谁编写了这些技能；重构日期和顺序虽与安装器记录一致，但反映的是分发关系而非作者身份（VI 节 Limitations）。
• 风险标签代表能力而非恶意：风险标记针对的是能力（capability）而非恶意意图（malice）（VI 节 Limitations）。
• 风险统计为下界：由于严格标记具有高精确率和低召回率，所统计的风险数量属于下界（VI 节 Limitations）。
• 时间与平台覆盖范围：数据仅覆盖该格式在公开 GitHub 上出现的前十个月，即分发实践形成的初期阶段（VI 节 Limitations）。

实验覆盖范围

• 被测数据集与文件对象：实验数据来源于 GitSkills 数据集，筛选 2025 年 10 月 1 日及之后首次提交的有效 SKILL.md，共覆盖 259,596 个非 fork 代码库和 1,612,846 个不同技能。
• 验证样本量：时间与来源重构算法在 1,534 个记录有来源与时间的安装器目录中进行验证。
• 标注规模与模型：人工与 LLM 标注实验包含 150 个源仓库类型抽样和 200 个分层抽样技能，后续由 Claude Opus 5.5 标注剩余 1,507 个源仓库。
• 审计评估切分点：时间切分评估以 2026 年 4 月 1 日为主切分点，并使用 2026 年 3 月 1 日和 5 月 1 日进行对比。
• 未报告信息：论文未报告私有仓库中的技能传播情况（论文仅在公开 GitHub 仓库上收集数据）。

• Research positioning: This paper is an empirical measurement and audit strategy study of the AI coding agent skill supply chain on GitHub.
• Core problem: Agent skills directly hold users' system permissions, but developers distribute them through cross-repository copying, lacking dependency declarations, package managers, and version tracking mechanisms, leaving security teams unable to determine key propagation sources and update fix scope.
• Method highlights: The authors mined git commit histories of all SKILL.md files from the GitSkills dataset, reconstructed a timestamped directed copy network and skill constellations, and trained a conditional logit source selection model to audit-rank potential high-risk distribution repositories.
• Main results:
  1. Skill copying exhibits directory-level preferential attachment and overdispersion, with the top 1% of repositories accounting for 94.7% of transmissions (Figure 2c), and 64.2% of repositories being isolated nodes (Figure 1a).
  2. GitHub stars do not reflect copy out-degree (Kendall τ = -0.10, Figure 2d), and 66.4% of unstarred top sources are ordinary projects (Figure 2f).
  3. Only 20.9% of skill copies follow subsequent modifications from source repositories (Figure 3g), and only 4.0% of clone lineages ever had consistent changes across all members (Figure 3d).
  4. Under the April 1, 2026 temporal split, auditing the top 100 repositories by the source selection model prevented 14.9% of high-risk adoptions in the held-out period, while auditing the top 100 high-star repositories prevented only 0.5% (Figure 4b).
• Conclusions and implications: The authors suggest that platform vendors should distribute skills as versioned references rather than direct file copies, and check at load time whether tool names match the target agent; auditors should prioritize review repositories based on copy out-degree rather than stars, and since new skill diffusion often takes weeks, defense teams have an action window.