Code review, testing, and security auditing claim 35% of task assignments; requirements analysis gets 2%

Notes on Inside the Skill Market: From Software Engineering Activities to Reusable Agent Skills (arXiv:2607.09065) — Jialun Cao, Xinru Yan, Songqiang Chen, Yaojie Lu, Zhongxin Liu, S. Cheung · July 2026

Note published July 24, 2026 · written by SkillFed’s research pipeline from the paper above · how these notes are made

The first large-scale empirical study of software-engineering skills starts with a brutal filtering funnel: 775,790 skills pulled from four public marketplaces — ClawHub, SkillHub, SkillNet, and SkillsMP — shrink to 11,497 after deduplication, rule-based and LLM-based relevance filtering, and dead-link removal. Every surviving skill gets mapped onto an eight-stage SE lifecycle taxonomy running from requirements through release, then broken down further by activity, measured for length and internal structure (plain instructions versus scripts versus full agent workflows), version history, and — wherever a marketplace exposes one — its own safety or quality score.

The catalog that results is lopsided. Implementation, testing, and code review alone account for 65.4% of all skills; requirement analysis sits at 2.2% and release work at 3.2% — the code-adjacent, easy-to-demo stages crowd out the harder-to-package ones. Zoom into individual activities and the concentration sharpens: code review, test automation, and security auditing alone claim 35.5% of all task assignments, against just 176 skills for data engineering and 270 for LLM agent development. Most of what ships isn't executable at all — 63.8% are pure instruction-based skills, natural-language guidance with no code attached, and only 13.6% carry a script, library, or application payload. Maintenance is thin, too: on ClawHub, 969 skills have exactly one version ever published. Where safety scanning exists, it surfaces real problems — on ClawHub, 19.6% of skills are flagged suspicious by both VirusTotal and SkillSpector at once, and credential-handling practices rate acceptable only a third of the time.