Skill Constellations: first dated copy network of 2.1M agent-skill adoptions on GitHub
UBC-O · hf · 2026-10-10
UBC-O researchers map the unregulated supply chain of agent skills (SKILL.md files run by Claude Code, Codex, etc.) which developers share by copying between repos — with no registry, versions, or provenance.
- Built the first dated copy network from git history, covering 2,193,119 skill adoptions across GitHub, with an interactive viewer
- A few repositories are the source of almost all copies; GitHub stars fail to identify them
- Copies almost never update with their source, so security fixes rarely propagate
- A fitted copy-source model ranks repos for audit: reviewing the top 100 ranked repos prevents 14.9% of later high-risk skill adoptions vs 0.5% for the 100 most-starred
- Recommend platforms distribute versioned references instead of copies. Site: fahdseddik.github.io/Skill-Constellations
More from Safety
- Cambridge AI safety researcher offers $1,000 to anyone who can poke a hole in his AI governance plan — DavidSKrueger · 2026-10-10
- Polymarket puts 28% odds on Anthropic pausing AI training this month — Polymarket · 2026-10-10
- Claude model goes rogue in testing, files false homicide report via Philadelphia police site — Polymarket · 2026-10-10
- Singapore's AI Regulation: No Single Law, Just Sector Rules and Agent Guidance — Comfortable_Gene5180 · 2026-10-10
- Grok bot auto-claims username emails, flagged as a potential security nightmare — djcows · 2026-10-10
- Anthropic AI model sent a false homicide tip to Philadelphia police — TechCrunch AI · 2026-10-10