Source-linked AI summary
Agent Skills: A Data-Driven Analysis of Claude Skills for Extending Large Language Model Functionality
George Ling, Shanshan Zhong, Richard Huang
TL;DR
Public evidence about what agent skills contain, how they are adopted, and what risks they pose remains limited as the ecosystem expands. The paper conducts a large-scale measurement of 40,285 publicly listed skills across production, adoption, redundancy, and safety. It finds rapid but uneven growth, concentrated adoption, pervasive redundancy, and a non-trivial subset enabling state-changing or system-level actions.
Problem
As public agent-skill marketplaces expand, it remains unclear what skills exist, how users adopt them, and what risks they pose.
Method
The paper analyzes 40,285 publicly listed skills across growth, content, adoption, redundancy, and safety dimensions.
Results
The ecosystem expands rapidly but unevenly: software engineering dominates supply, adoption concentrates on information retrieval and content creation, redundancy is pervasive, and some skills enable state-changing or system-level actions.
Takeaways & Limitations
The findings motivate better skill discovery, de-duplication, quality signals, permission models, sandboxing, and transparent risk labeling.
Takeaways & Limitations
The study uses one early-February 2026 snapshot from a single marketplace and publicly visible adoption signals rather than verified executions.
Abstract
from arXiv · showhide
Agent skills extend large language model (LLM) agents with reusable, program-like modules that define triggering conditions, procedural logic, and tool interactions. As these skills proliferate in public marketplaces, it is unclear what types are available, how users adopt them, and what risks they pose. To answer these questions, we conduct a large-scale, data-driven analysis of 40,285 publicly listed skills from a major marketplace. Our results show that skill publication tends to occur in short bursts that track shifts in community attention. We also find that skill content is highly concentrated in software engineering workflows, while information retrieval and content creation account for a substantial share of adoption. Beyond content trends, we uncover a pronounced supply-demand imbalance across categories, and we show that most skills remain within typical prompt budgets despite a heavy-tailed length distribution. Finally, we observe strong ecosystem homogeneity, with widespread intent-level redundancy, and we identify non-trivial safety risks, including skills that enable state-changing or system-level actions. Overall, our findings provide a quantitative snapshot of agent skills as an emerging infrastructure layer for agents and inform future work on skill reuse, standardization, and safety-aware design.
1 Introduction
Agent skills package reusable agent behaviors into selectable modules, addressing repeated prompt-based specification as the ecosystem expands. This paper measures their growth, content, adoption, redundancy, and safety risks at scale.
- Research scope: The ecosystem’s rapid expansion motivates systematic analysis of what skills exist, how users adopt them, and what risks they introduce.The paper presents a large-scale, data-driven measurement of the emerging ecosystem.
- What are agent skills?: Agent skills are reusable, plug-and-play modules specifying when to invoke a behavior and how to execute its sub-task.They can combine discovery metadata with executable instructions and supporting resources.
- Why do agents need skills?: Recurring behaviors otherwise require repeated prompts or ad hoc control logic, increasing prompt overhead, brittleness, and maintenance difficulty.Skills package task knowledge, procedural logic, and tool-use patterns into reusable and composable units.
- How are agent skills used in practice?: Agents typically load eligible skill metadata into the system prompt, select a skill for the user request, and follow its instructions while issuing tool calls.Skills are organized as self-contained modules selected and executed during task solving.
- Research scope: The study analyzes growth, heavy-tailed length and redundancy, taxonomy-based usage patterns, supply–demand gaps, and safety risks.It reports six major categories and twenty sub-categories, concentration in software engineering workflows, and state-changing actions among a non-trivial share of skills.
2 Skill Data and Growth Trends
The dataset contains 40,285 marketplace skill records collected on February 5, 2026, revealing rapid, bursty publication growth that coincided with a community-attention surge.
- Dataset construction: 40,285 skill metadata records were collected from skills.sh on February 5, 2026, using publicly accessible metadata and aggregate reporting.Records include names, repositories, first-seen dates, and platform installation counts.
- Growth trends: Skills grew from 2,179 on January 16 to 40,285 on February 5, an 18.5× increase over 20 days.The net increase was 38,106 skills, averaging about 15.7% multiplicative growth per day.
- Growth trends: 8,857 skills were added on January 25, representing 23.2% of all new skills in the observation window.The week centered on January 25 contributed 19,259 skills, or 47.8% of the snapshot.
- Growth trends: OpenClaw gained 25,432 GitHub stars on January 26, 2.4× the previous day, while daily gains later declined alongside new listings.The synchronized dynamics suggest shared public attention, although stars are an imperfect usage proxy.
- Length distribution: Skill lengths are heavy-tailed: the median is 1,414 tokens, 90% are at most 3,935, and the maximum is 116,239 tokens.The accompanying distribution shows most skills are compact despite a small number of exceptionally long entries.
3 Skill Length and Redundancy
Most skills are compact enough for typical prompt contexts, but the marketplace contains substantial repetition and a smaller set of extreme-length entries that complicate selection and maintenance.
- Skill length: The median skill length is 1,414 tokens and 95% of skills are within 5,077 tokens, despite a standard deviation of 2,025 tokens.The central mass is short, while the distribution remains strongly dispersed.
- Skill length: The longest skill reaches 116,239 tokens, and the top 1% exceed 9,253 tokens, potentially consuming prompt budgets when loaded in full.Long entries often consolidate documentation, code blocks, and reusable template collections.
- Redundancy: Redundancy is measured through normalized exact-name matching and semantic embeddings, but strict name matching anchors the main results because descriptions are short and noisy.Embedding-based analysis is reported separately in the appendix.
- Redundancy: 46.3% of skills share a normalized name with at least one other listing, while 53.7% appear only once under strict exact matching.Pairs account for 18.7% of the corpus, and 5×–9× groups account for 14.3%.
- Redundancy: High redundancy increases search costs, fragments feedback and adoption signals, and makes strong implementations harder to recognize as defaults.The paper connects this pattern to re-packaging common workflows and proposes canonical skills, versioning, and modular templates.
- Taxonomy: The taxonomy organizes skills into 6 major categories and 20 sub-categories, reporting size, average token length, and mean downloads or installs.It separates practical intents such as Code Generation and Debug & Analysis.
4 Skill Usage Patterns
The taxonomy compares what developers publish with what users install across six major and 20 sub-categories. Software engineering dominates supply, while adoption concentrates in retrieval and content-creation capabilities, producing clear supply–demand gaps.
- Taxonomy and classification: The taxonomy contains 6 major categories and 20 sub-categories for comparing skill functionality, length, and adoption.Skills are classified with Qwen2.5-32B-Instruct because marketplace tags are sparse and inconsistent.
- Skill length: Data Visualization and Data Processing are the longest sub-categories, averaging 2,322 and 2,134 tokens, respectively.Version Control and Local File Control are shorter, averaging 1,403 and 1,420 tokens.
- Distribution of skills: 54.7% of listings belong to Software Engineering, with Infrastructure alone comprising 9,664 skills or 24.0% of the corpus.Infrastructure covers environment setup, DevOps automation, tool configuration, and deployment.
- Adoption patterns: Web Search has the highest mean downloads at 1,268 despite representing only 1.4% of listings.Other highly adopted categories include Audio & Video at 266, Image Generation at 214, and Code Generation at 235 mean installs.
- Implications: The taxonomy distinguishes what developers build from what users reuse and clarifies how content complexity varies across functions.The sub-category comparison extends the supply–demand analysis to all 20 sub-categories.
- Supply–demand dynamics: Most categories broadly align supply with demand, but content creation and information retrieval are demand-heavy while software engineering is supply-heavy.Supply counts de-duplicated skills; demand is average installs per skill, used as a coarse adoption proxy.
5 Risk and Safety Assessment
The paper audits skill risks from privacy-sensitive access through critical capabilities using a four-level rubric. Low-risk skills dominate overall, but action-enabling and system-level capabilities are widespread, especially in externally connected categories.
- Audit protocol: The audit assigns exactly one risk level from L0 to L3 using Qwen2.5-32B-Instruct under a worst-case interpretation.The model receives each skill’s name, description, and full SKILL.md content and returns a strict JSON record.
- Overall risk distribution: 54% of skills are L0, 5% L1, 30% L2, and 9% L3 under the paper’s risk-level distribution.L0 is lowest risk and L3 is highest risk.
- Overall risk distribution: Nearly two fifths of the marketplace can access sensitive context or perform writes and actions, while a nontrivial share exposes critical capabilities.The risk assessment covers privacy-sensitive reads, state-changing actions, and critical capabilities such as arbitrary command execution.
- Category-level patterns: Content Creation is safest at 75% L0, Information Retrieval is 68% L0 with the largest L1 share at 11%, and Productivity Tools is dominated by L2 at 46%.These patterns correspond respectively to draft or media outputs, private-source connectors, and actions involving emails, messages, calendars, and documents.
- Risk-level semantics: Risk-level word clouds associate L1 with private data, L2 with action words, and L3 with critical system and security terms.Examples include “meeting” and “history” for L1, “git” and “merge” for L2, and “sudo,” “admin,” and “password” for L3.
- Implications: The results motivate least-privilege tool design and additional safeguards for high-risk operations.The authors identify action-enabling skills as a reason for safety-aware design.
6 Potential Directions
The paper identifies directions for improving agent-skill ecosystems by addressing redundancy, prompt overhead, supply–demand mismatch, and safety risks. Proposed responses include canonicalization, selective loading, demand-driven authoring, and least-privilege sandboxing.
- Quality and reuse: Semantic de-duplication and quality signals should address pervasive intent-level duplication and support canonical skills per intent.Suggested signals include documentation, execution reliability, maintenance, and usage.
- Efficiency: Selective loading and modularization should reduce prompt overhead caused by a heavy-tailed skill-length distribution.Systems can retrieve only the steps, parameters, and tool schemas needed for the current subgoal.
- Supply and demand: Demand signals can guide authoring, incentives, and review because publication effort does not always track user adoption.Information retrieval has high usage but is costly to build and maintain, while software-engineering skills often compete as close substitutes.
- Safety: Standardized sandboxing and least-privilege controls are proposed to manage high-risk skills that enable state-changing actions.The goal is to support complex tasks while protecting host systems from unauthorized or malicious operations.
7 Conclusion
The study measures the agent-skill ecosystem across production, adoption, redundancy, and safety, finding rapid but uneven expansion. Supply is concentrated in software engineering, adoption in selected high-demand capabilities, redundancy is pervasive, and some skills enable state-changing or system-level actions.
- Scope: Over 40,000 publicly listed skills were analyzed in a large-scale, data-driven measurement of the agent-skill ecosystem.The analysis covers production, adoption, redundancy, and safety auditing.
- Ecosystem patterns: Software engineering dominates supply, while information retrieval and content creation attract concentrated adoption.The conclusion characterizes the ecosystem as expanding quickly but unevenly.
- Ecosystem patterns: Intent-level redundancy is pervasive across the ecosystem.This finding motivates future work on standardization and reuse.
- Safety: Most skills appear low risk, but a non-trivial subset enables state-changing or system-level actions.The conclusion underscores the need for safety-aware skill design and review.
Limitation
The study’s evidence is bounded by a single early-February 2026 snapshot from one public marketplace and by adoption measures based on visible signals rather than verified executions. These choices may limit how well the reported supply, demand, and growth patterns represent evolving or private deployments.
- Scope: The measurements come from one public marketplace snapshot collected around early February 2026.Changing platform policies, ranking algorithms, and community composition may alter supply, demand, and bursty growth patterns.
- Measurement: Adoption is operationalized through publicly visible signals rather than verified executions inside deployed agents.These signals may be affected by interface changes, caching, coordinated promotion, and underrepresentation of private usage.
A.1 Skill Structure
Agent skills are structured as reusable, program-like units whose metadata supports discovery, instructions encode procedures, and resources connect execution to external tools. During execution, agents select skills conditionally, load detailed specifications, and update control flow through intermediate outputs.
- Skill structure: A skill is represented as a structured abstraction whose metadata, instructions, and resources support reusable task execution.Metadata specifies applicability, instructions define procedural steps, and resources link external tools, scripts, APIs, or artifacts.
- Skill structure: SKILL.md separates lightweight discovery metadata from detailed procedural execution and associated resources.Only metadata is initially exposed, while full instructions and resources load after selection to limit baseline context.
- Dynamic integration: Agents select skills by reasoning over an indexed list of names and descriptions in response to user goals and subgoals.Selection is conditional rather than tied to a fixed execution pipeline.
- Dynamic integration: Invoked skills can use external tools and produce structured intermediate outputs that influence subsequent decisions.An analysis result may determine whether the agent refines, explores alternatives, or synthesizes.
- Dynamic integration: Figure 11 depicts a non-linear loop of state reasoning, skill selection, and execution without hard-coded orchestration rules.Transitions between skills are determined by intermediate state updates.
B Additional Analysis of Redundancy
The redundancy analysis combines exact name matching with semantic visualization to capture both repeated labels and overlapping functionality. Together, these views indicate that many skill listings share intent, including when their names differ.
- Exact name matching is conservative because it misses paraphrased listings, motivating the near-duplicate analysis.
- Semantic embedding visualization shows visible clusters within and across sub-categories, suggesting overlapping intent even when names differ.
C Additional Analysis of Risk and Safety Assessment
The paper assesses skill security risk with LLM-based auditing and aggregates the resulting labels by taxonomy sub-category. The protocol uses worst-case interpretation and distinguishes four risk levels, including high-impact actions at L3.
- Sub-category risk analysis: Risk labels are aggregated within each of the 20 sub-categories to identify where risks concentrate.
- Skill classification: The classification prompt supplies definitions for 6 major categories and 20 sub-categories, using each skill’s name and description as input.The model returns a strict JSON label and brief justification for reliable parsing and auditing.
- Security risk assessment: The security prompt considers interactions with data and tools and assigns the highest applicable level under a worst-case interpretation.L3 includes destructive writes and arbitrary command execution.
F The Examples of High-Risk (L3) Skills
The high-risk examples span database, financial, content, credential, file, and code-execution capabilities. Across these cases, the reported concerns include irreversible data loss, unauthorized access, financial loss, and system compromise.
- High-Risk (L3) Skills: L3 examples include arbitrary command execution, credential handling, privileged-access escalation, and financial-asset operations.
- Database and data operations: Database skills can perform writes, deletions, schema changes, or destructive SQL operations that may cause irreversible data loss or corruption.
- Financial operations: Financial and blockchain skills can transfer money, manage wallets, create tokens, provision liquidity, or allocate assets, risking financial loss or manipulation.
- Content, system, and credential operations: Other high-risk examples cover unauthorized publishing, low-level file and process operations, credential exposure, destructive deletion, and password brute-forcing.
- Code and command execution: Code-execution skills using APIs, shells, Python interpreters, or command interfaces can enable arbitrary or remote code execution and system compromise.