Agent-skill copies rarely sync upstream, GitHub map finds

Agent "skills," the SKILL.md instructions that AI coding agents such as Claude Code and Codex run with the permissions of their user, spread across GitHub as plain copies that almost never update when the source does, according to a new arXiv paper by Fahd Seddik.

"Developers share skills by copying them between repositories, which makes them a software supply chain without a registry, versions or provenance," the paper argues. The result, Seddik writes, is that "the origin of a copied skill, the reach of a security fix and the repositories that warrant review are therefore unknown."

The study builds the first dated copy network of agent skills from the git history of every SKILL.md in GitSkills, covering 2,193,119 skill adoptions across GitHub. The topology is lopsided: "A few repositories are the source of almost all copies, and GitHub stars do not identify them."

That matters for anyone deciding what to audit. Seddik fits a model of which repositories others copy from and uses it to rank repositories for security review. Reviewing the top 100 "prevents 14.9% of later adoptions of high-risk skills, against 0.5% for the 100 most starred," roughly a thirty-fold gap against the obvious popularity baseline.

The follow-on problem is patching. Because "skill copies almost never change with their source," a vulnerability fixed in a widely-copied SKILL.md is unlikely to propagate to the agents that already imported it. The abstract reports no per-adoption modification rates and no per-detector accuracy numbers to quantify how large that drift really is.

The paper's prescription is a platform-level change rather than a per-user one: "Platforms should therefore distribute versioned references rather than copies."