{ "schema_version": 1, "builder_plan": { "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.", "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.", "baseline": "Your existing checks with the same tasks, permissions, and tool responses.", "steps": [ "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.", "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.", "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.", "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test." ], "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.", "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation." }, "builder_review": null, "arxiv_id": "2610.11169", "title": "Skill Constellations: Tracing the Supply Chain of Agent Skills on GitHub", "summary": "This is an empirical supply-chain measurement of SKILL.md files on GitHub plus a ranking model that prioritizes which source repositories to audit, replacing the common heuristic of using GitHub stars to identify influential skill sources. It costs nothing to adopt directly as an inference technique because it is a dataset and analysis, but reproducing it requires processing git history across 2.19 million skill adoptions, which exceeds a constrained team's practical scope; the usable artifact is the released viewer and ranked list. It can fail if copy patterns shift after the study's snapshot, if private or non-GitHub skill distribution dominates an organization's exposure, or if 'high-risk' labels in the dataset do not match the adopter's threat model.", "rationale": "The paper delivers a measurement finding and an audit-prioritization list rather than a deployable method, so the reader should monitor it and use the released ranked list when vetting third-party agent skills rather than adopt any pipeline.", "technique": "Dated skill copy network for audit ranking", "family": "seguranca_e_guardrails", "recommendation": "observar", "published": "2026-10-08", "as_of": "2026-10-18", "editorial_status": "indexed", "source_url": "https://arxiv.org/abs/2610.11169", "independent_implementations": 2, "total_implementations": 3, "stars": 0, "citations": 0, "claims": [ { "claim_id": "claim-01", "statement": "This is an empirical supply-chain measurement of SKILL.md files on GitHub plus a ranking model that prioritizes which source repositories to audit, replacing the common heuristic of using GitHub stars to identify influential skill sources. It costs nothing to adopt directly as an inference technique because it is a dataset and analysis, but reproducing it requires processing git history across 2.19 million skill adoptions, which exceeds a constrained team's practical scope; the usable artifact is the released viewer and ranked list. It can fail if copy patterns shift after the study's snapshot, if private or non-GitHub skill distribution dominates an organization's exposure, or if 'high-risk' labels in the dataset do not match the adopter's threat model.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.11169", "source_page": null, "source_excerpt": "" }, { "claim_id": "claim-02", "statement": "Auditing the top-100 repositories ranked by the paper's copy-propagation model prevents 14.9% of later adoptions of high-risk skills, versus 0.5% for the 100 most-starred repositories (approximately 30x better targeting).", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.11169", "source_page": null, "source_excerpt": "" } ], "exposure_map": [ { "dimension": "quality", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compute", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "latency", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "operations", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compatibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "security", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "data_and_training", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "reproducibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" } ], "risks": [], "minimum_test": [], "open_questions": [], "independent_tests": [], "lab_reproductions": [], "report_available": false, "validation_tier": "unknown", "evidence_tier": "unknown", "infrastructure_basis": "unknown", "equations": [], "equations_status": "not_fetched", "core_kind": "", "equations_fetched_at": "", "equations_source_url": "", "equations_source_sha256": "", "exposures_reviewed_at": "", "exposures_source_sha256": "" }