AI agent skills: 2.2 million copies on GitHub, and patches almost never make it back to the repositories that forked them

A study traces which SKILL.md files are copied onto GitHub. A few repositories are responsible for almost all of them, and auditing 100 carefully selected ones would identify 30 times as many at-risk skills as auditing the 100 most highly rated ones.

Skills are instructions and scripts (SKILL.md files) that programming agents such as Claude Code or Codex execute with the rights of their user. Developers share them by copying them from one repository to another: the result is a software supply chain with no registry, version number or traceability. No one knows where a copied skill came from, or if the correction of a flaw has been propagated.

A dated network of copies

Fahd Seddik has reconstructed, from the git history of each SKILL.md listed by GitSkills, the first dated network of these copies: 2,193,119 adoptions on GitHub, which can be consulted in a visualization tool. Two observations stand out. A handful of repositories are at the origin of almost all the copies, without the number of stars allowing them to be identified. And the copies almost never follow the evolution of their source, so much so that a patch published beforehand only rarely reaches the repositories that have taken it over.

The author proposes a model that predicts the repositories that others are inspired by, in order to prioritize audits. Looking at the top 100 repositories would prevent 14.9% of subsequent adoptions of high-risk skills, compared to 0.5% by targeting the 100 most starred repositories. He recommends that platforms distribute versioned references rather than copies.