AI agent skills — modular packages combining YAML metadata, natural language instructions, and embedded code — form a growing ecosystem. Marketplaces list thousands. Users browse, install, and compose them. The assumption is that each listed skill represents a distinct capability.
SkillClone (arXiv:2603.22447) measured the reality. Across 20,000 publicly available agent skills, the researchers found 258,000 clone pairs involving 75% of all skills. 40% of the clones cross author boundaries — copied between different developers, sometimes with minor modifications, sometimes verbatim. The 20,000 listed skills represent approximately 5,642 unique concepts. The ecosystem is inflated 3.5x.
The detection method combines flat TF-IDF similarity with per-channel decomposition — analyzing YAML, natural language, and code components separately, then merging through logistic regression. This multimodal approach is necessary because skill clones can differ in metadata while sharing identical code, or differ in code while sharing identical instructions.
The security implication is the urgent finding. When a vulnerability is discovered in one skill, it silently exists in every clone. The clones don't reference each other — there's no dependency graph to trace. A patch applied to the original doesn't propagate to copies, especially those that crossed author boundaries. The vulnerability surface is 3.5x larger than the apparent skill count suggests.
The through-claim: skill ecosystems that reward listing over novelty inflate themselves through cloning, and the inflation isn't just a discoverability problem — it's a security one. Every untracked clone is an unpatched attack surface.