Nearly 1 in 5 Skill Forks Add Security-Sensitive Instructions
Notes on An Empirical Study of Downstream Adaptation for Agent Skills (arXiv:2607.03238) — Xinjian Wu, Jingzhi Gong, Gunel Jahangirova, Zhenpeng Chen, Jie M. Zhang · July 2026
Note published · written by SkillFed’s research pipeline from the paper above · how these notes are made
AI-assisted notes · reviewed by SkillFed Skill security Bridge: security × benchmarksResearchers screened GitHub for agent skill repositories with at least 20,000 stars and 2,000 forks and landed on six, including Anthropic's own anthropics/skills, obra/superpowers, and affaan-m/everything-claude-code. Those six repos alone had 67,264 public forks. Filtering out inactive branches, upstream-sync noise, and edits that never touched an actual skill package brought that down to 1,220 branch comparisons -- each one a developer's real, deliberate change to an existing skill. An LLM agent read every diff and built a taxonomy from the patch content itself rather than from commit messages; two human auditors checked a random sample and hit κ=0.83 agreement, solid enough to trust the result: 1,126 validated adaptation instances, sorted into 46 patterns across 13 families.
The headline finding is a reuse paradox: skills ship for drop-in reuse, yet the most common fork-level edit is rewriting the skill's own metadata/description field -- the routing signal an agent uses to decide the skill is relevant in the first place. Adding procedure steps, decision rules, and hard constraints follows close behind. SKILL.md gets touched in 79.8% of every adaptation instance, against 23.3% for bundled scripts -- the markdown instruction file, not the code underneath it, is the real control plane developers are fighting with. These edits rarely land alone: procedure, decision, and policy changes co-occur far more than chance would predict, with lift as high as 3.53. And 18.6% of adaptations introduce content matching security-sensitive patterns, access to sensitive files topping the list. 73.1% of those matches sit inside SKILL.md or bundled docs rather than executable scripts -- invisible to any review process that only scans code.
Key numbers
| Skill-adaptation instances analyzed | 1,126 |
| Adaptation patterns / families | 46 / 13 |
| Adaptations touching SKILL.md | 79.8% |
| Adaptations adding security-sensitive content | 18.6% |
| Of those, hidden in prose rather than scripts | 73.1% |
Skills related to this research
Related notes
- 40,285 Skills Later, Supply Still Doesn't Match Demand →
- Code review, testing, and security auditing claim 35% of task assignments; requirements analysis gets 2% →
- 26.1% of Community Skills Ship With a Vulnerability →
- Flat retrieval breaks once a skill library hits the tens-to-hundreds range →
- A skill improves every time anyone uses it, not just its author →
- SKILL.md files average 10.5 quality smells, and age doesn't cure them →
- A nano model beats a flagship one, 0.7758 vs 0.7620, by editing its own harness →
- Evolving the improver — not just the skill — accounts for all of ALFWorld's gain and half of SealQA's →
- Task-decomposition reranking beats the best baseline 78.7 vs 73.1 on ALFWorld-unseen, using just 1.3 skills per task →
References
- Wu, X., Gong, J., Jahangirova, G., Chen, Z., & Zhang, J. M. (2026). An Empirical Study of Downstream Adaptation for Agent Skills. arXiv:2607.03238.
- Anthropic and the Agent Skills community. (2025). Agent Skills: A standardized way to give AI agents new capabilities and expertise.
- Liu, Y., Wang, W., Feng, R., Zhang, Y., Xu, G., Deng, G., Li, Y., & Zhang, L. (2026). Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale. arXiv.
- Zhou, Y., Shu, W., Su, Y., Du, W., Fang, Y., & Lin, X. (2026). A Comprehensive Survey on Agent Skills: Taxonomy, Techniques, and Applications. arXiv:2605.07358.