Skills Are Not Islands: Measuring Dependency and Risk in Agent Skill Supply Chains

Source

• Source name: arXiv
• Source kind: paper
• Authors / organization: Changguo Jia, Tianqi Zhao, Runzhi He, Minghui Zhou
• Venue: arXiv: cs.SE
• Published: 2026-07-01
• Collected: 2026-07-02
• URL: http://arxiv.org/abs/2607.01136v1
• PDF: https://arxiv.org/pdf/2607.01136v1
• DOI: UNKNOWN

Plain-Language Brief

Researchers introduce Agent Skill Supply Chains (ASSCs) to manage the dependencies of Large Language Model (LLM) agents by characterizing their dependency graphs. The study finds that ASSCs have four structural patterns and can help identify malicious skills. They recommend several measures for improving skill infrastructure management.

What the Document Says

• Agent Skill Supply Chains (ASSCs) are introduced to manage dependencies of LLM agents by characterizing their dependency graphs.
• Four structural patterns found in ASSCs: skill metadata is activation-ready but governance-poor, dependency graphs span skill, package, and service dependencies with concentrated reuse, recursive skill reuse expands dependency graphs and creates hidden package inventory, skill dependency clusters form around related workflows.
• Inspecting a skill alone misses security-relevant signals hiding in its dependencies.
• Applying SkillDepAnalyzer to over 1.43 million skills obtained ASSCs and explored their structural diversity and security signals.
• SkillDepAnalyzer outperforms an LLM-based baseline and package-centric SBOM tools on the SKILL-DEP benchmark.
• Known malicious skills persisting in ASSCs are identified and reported to their developers.
• Recommendations for improving skill infrastructure management: typed dependency manifests, first-class dependency-cluster management, risk-warning audit commands for skill infrastructure maintainers, and lockfile-like records for skill developers.

Key Concepts Mentioned

• Agent Skill Supply Chains (ASSCs)
• Large Language Model (LLM) agents
• Dependency Management
• SkillDepAnalyzer
• SKILL-DEP benchmark

Claims Made by the Document

• Assessing dependency of LLM agents is a gap in dependency management.
• SkillDepAnalyzer accurately and comprehensively recovers skill metadata and dependency graphs.
• Four structural patterns exist in ASSCs.
• Inspecting a skill alone misses security-relevant signals hiding in its dependencies.

Evidence Used

• Agent skills package operational knowledge for LLM agents... yet as they grow in scope, they become dependency-bearing artifacts whose identities, versions, and provenance remain implicit.
• On the SKILL-DEP benchmark, SkillDepAnalyzer recovers skill metadata and dependency graphs accurately and comprehensively.
• We find four structural patterns...
• Inspecting a skill alone misses security-relevant signals hiding in its dependencies.

Methods / Approach

UNKNOWN

Limitations Stated by the Authors

UNKNOWN

Limitations Noted by the Agent

Agent interpretation — not from the source.

UNKNOWN

Open Questions

UNKNOWN

Notes for Future Q&A

May include interpretation. Labeled where it does.

UNKNOWN

Raw Abstract / Excerpt

Agent skills package reusable operational knowledge for Large Language Model (LLM) agents, yet as they grow in scope, they become dependency-bearing artifacts whose identities, versions, and provenance remain implicit. This opacity already causes duplicated dependencies and inconsistent installations, exposing a gap that dependency management has yet to close. We introduce Agent Skill Supply Chains (ASSCs) to characterize mixed skill-package-service dependency graphs and help close this gap. Borrowing from Software Bill of Materials (SBOMs), we design SkillDepAnalyzer to capture natural-language dependency evidence and model skills as dependency-bearing artifacts. On the SKILL-DEP benchmark, SkillDepAnalyzer recovers skill metadata and dependency graphs accurately and comprehensively, substantially outperforming an LLM-based baseline and package-centric SBOM tools. Applying SkillDepAnalyzer to over 1.43 million skills, we obtain ASSCs and explore their structural diversity and security signals. We find four structural patterns: skill metadata is activation-ready but governance-poor; dependency graphs span skill, package, and service dependencies with concentrated reuse; recursive skill reuse expands dependency graphs and creates hidden package inventory; and skill dependency clusters form around related workflows. We also find that inspecting a skill alone misses security-relevant signals hiding in its dependencies. By analyzing ASSCs, we identify and report known malicious skills persisting in ASSCs to their developers. Based on these findings, we recommend typed dependency manifests, first-class dependency-cluster management, risk-warning audit commands for skill infrastructure maintainers, and lockfile-like records for skill developers.