发表机构
University of British Columbia（不列颠哥伦比亚大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本研究构建了首个带时间戳的GitHub智能体技能复制网络，拟合模型对需审计代码仓库排名，审查排名最高的100个仓库可阻止14.9%高风险技能后续采用，为安全工程师提供了技能传播前的检查清单。
AI 中文摘要
智能体技能是Claude Code、Codex等AI编码智能体在用户授权下运行的指令和脚本。开发者通过在代码仓库间复制技能来共享它们，这形成了一个没有注册表、版本或来源追溯的软件供应链。因此，被复制技能的来源、安全修复的覆盖范围以及需要审查的代码仓库都是未知的。仅在单一时间点记录哪些代码仓库持有某一技能的研究，无法揭示谁从谁那里复制了该技能。我们贡献了首个带时间戳的智能体技能复制网络，该网络基于GitSkills中所有GitHub仓库的Git历史构建，覆盖了GitHub上2,193,119次技能采用，同时提供了交互式查看工具。少数代码仓库是几乎所有复制行为的来源，且GitHub星标无法识别这些来源。技能复制几乎不会随其来源发生变化，因此来源处的修复很少能传递到复制的技能上。我们拟合了一个模型，用于判断其他代码仓库会从哪些代码仓库复制技能，并使用该模型对需要审计的代码仓库进行排名。审查排名最高的100个代码仓库可阻止14.9%的高风险技能后续采用，而审查星标最多的100个代码仓库仅能阻止0.5%，这为安全工程师提供了一份在技能传播前需检查的简短清单。因此，平台应分发带版本的引用而非副本。项目网站：[此处保留原链接]
英文摘要
Agent skills are SKILL.md instructions and scripts that AI coding agents such as Claude Code and Codex run with the permissions of their user. Developers share skills by copying them between repositories, which makes them a software supply chain without a registry, versions or provenance. The origin of a copied skill, the reach of a security fix and the repositories that warrant review are therefore unknown. Studies that record which repositories hold a skill at a single point in time cannot reveal who copied it from whom. We contribute the first dated copy network of agent skills, built from the git history of every SKILL.md in GitSkills and covering 2,193,119 skill adoptions across GitHub, together with an interactive viewer. A few repositories are the source of almost all copies, and GitHub stars do not identify them. Skill copies almost never change with their source, and a fix at the source therefore rarely reaches them. We fit a model of which repositories others copy from and use it to rank repositories for audit. Reviewing the 100 repositories it ranks highest prevents 14.9% of later adoptions of high-risk skills, against 0.5% for the 100 most starred, which gives security engineers a short list to check before a skill spreads. Platforms should therefore distribute versioned references rather than copies. Project Website: https://fahdseddik.github.io/Skill-Constellations/
CommentsProject Website: https://fahdseddik.github.io/Skill-Constellations/
