← Sunday, October 11, 2026AgentsPaper

Agent-skill copy networks reveal where security fixes fail to propagate

huggingface.co by Fahd Seddik Editor score 9/10

A dated network covering 2,193,119 skill adoptions finds that copied skills rarely change with their source; auditing the top 100 ranked repositories prevents 14.9% of later high-risk adoptions, versus 0.5% for the 100 most-starred. The findings offer concrete ways to prioritize agent-skill supply-chain reviews.

What

Agent skills are SKILL.md instructions and scripts run by coding agents with their users’ permissions, shared by copying across GitHub repositories.

Method

Git history yields a dated copy network; copies rarely change with their source, so source fixes seldom propagate.

Why it matters

A model-ranked audit of 100 repositories prevents 14.9% of later high-risk skill adoptions, versus 0.5% for the 100 most-starred repositories.

Read on huggingface.co → Code

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.