{"id":"https://openalex.org/W7167053688","doi":"https://doi.org/10.48550/arxiv.2607.01136","title":"Skills Are Not Islands: Measuring Dependency and Risk in Agent Skill Supply Chains","display_name":"Skills Are Not Islands: Measuring Dependency and Risk in Agent Skill Supply Chains","publication_year":2026,"publication_date":"2026-07-01","ids":{"openalex":"https://openalex.org/W7167053688","doi":"https://doi.org/10.48550/arxiv.2607.01136"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2607.01136","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.01136","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2607.01136","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5013923377","display_name":"Changguo Jia","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jia, Changguo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5111365179","display_name":"Tianqi Zhao","orcid":"https://orcid.org/0009-0008-9017-427X"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhao, Tianqi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5050104648","display_name":"Runzhi He","orcid":"https://orcid.org/0000-0002-6181-6519"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"He, Runzhi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5139860547","display_name":"Minghui Zhou","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhou, Minghui","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.30649998784065247,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.30649998784065247,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.26190000772476196,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.07509999722242355,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/dependency","display_name":"Dependency (UML)","score":0.8637999892234802},{"id":"https://openalex.org/keywords/dependency-graph","display_name":"Dependency graph","score":0.609499990940094},{"id":"https://openalex.org/keywords/reuse","display_name":"Reuse","score":0.5180000066757202},{"id":"https://openalex.org/keywords/audit","display_name":"Audit","score":0.5167999863624573},{"id":"https://openalex.org/keywords/metadata","display_name":"Metadata","score":0.5044999718666077},{"id":"https://openalex.org/keywords/baseline","display_name":"Baseline (sea)","score":0.4772000014781952},{"id":"https://openalex.org/keywords/supply-chain","display_name":"Supply chain","score":0.4449000060558319},{"id":"https://openalex.org/keywords/software-inspection","display_name":"Software inspection","score":0.35249999165534973},{"id":"https://openalex.org/keywords/artifact","display_name":"Artifact (error)","score":0.34610000252723694}],"concepts":[{"id":"https://openalex.org/C19768560","wikidata":"https://www.wikidata.org/wiki/Q320727","display_name":"Dependency (UML)","level":2,"score":0.8637999892234802},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7045000195503235},{"id":"https://openalex.org/C16311509","wikidata":"https://www.wikidata.org/wiki/Q4148050","display_name":"Dependency graph","level":3,"score":0.609499990940094},{"id":"https://openalex.org/C206588197","wikidata":"https://www.wikidata.org/wiki/Q846574","display_name":"Reuse","level":2,"score":0.5180000066757202},{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.5167999863624573},{"id":"https://openalex.org/C93518851","wikidata":"https://www.wikidata.org/wiki/Q180160","display_name":"Metadata","level":2,"score":0.5044999718666077},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.4772000014781952},{"id":"https://openalex.org/C108713360","wikidata":"https://www.wikidata.org/wiki/Q1824206","display_name":"Supply chain","level":2,"score":0.4449000060558319},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3767000138759613},{"id":"https://openalex.org/C10272871","wikidata":"https://www.wikidata.org/wiki/Q929972","display_name":"Software inspection","level":5,"score":0.35249999165534973},{"id":"https://openalex.org/C2779010991","wikidata":"https://www.wikidata.org/wiki/Q2720909","display_name":"Artifact (error)","level":2,"score":0.34610000252723694},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.3402999937534332},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.3345000147819519},{"id":"https://openalex.org/C206345919","wikidata":"https://www.wikidata.org/wiki/Q20380951","display_name":"Resource (disambiguation)","level":2,"score":0.3310999870300293},{"id":"https://openalex.org/C2777960535","wikidata":"https://www.wikidata.org/wiki/Q131508","display_name":"Enterprise resource planning","level":2,"score":0.31349998712539673},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.31200000643730164},{"id":"https://openalex.org/C2781426361","wikidata":"https://www.wikidata.org/wiki/Q5326940","display_name":"Earnings","level":2,"score":0.2973000109195709},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2928999960422516},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.28679999709129333},{"id":"https://openalex.org/C177225278","wikidata":"https://www.wikidata.org/wiki/Q192674","display_name":"Factoring","level":2,"score":0.2838999927043915},{"id":"https://openalex.org/C2780378061","wikidata":"https://www.wikidata.org/wiki/Q25351891","display_name":"Service (business)","level":2,"score":0.27489998936653137},{"id":"https://openalex.org/C35578498","wikidata":"https://www.wikidata.org/wiki/Q193424","display_name":"Web service","level":2,"score":0.2741999924182892},{"id":"https://openalex.org/C132758656","wikidata":"https://www.wikidata.org/wiki/Q5307365","display_name":"Dreyfus model of skill acquisition","level":2,"score":0.27250000834465027},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.2696000039577484},{"id":"https://openalex.org/C33762810","wikidata":"https://www.wikidata.org/wiki/Q461671","display_name":"Data integrity","level":2,"score":0.26669999957084656},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.265500009059906},{"id":"https://openalex.org/C152752567","wikidata":"https://www.wikidata.org/wiki/Q116877","display_name":"Code refactoring","level":3,"score":0.2590999901294708},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.2531000077724457},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.2524000108242035}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2607.01136","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.01136","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2607.01136","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.01136","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Agent":[0,50],"skills":[1,83,193],"package":[2,159],"reusable":[3],"operational":[4],"knowledge":[5],"for":[6,215,222],"Large":[7],"Language":[8],"Model":[9],"(LLM)":[10],"agents,":[11],"yet":[12,45],"as":[13,84],"they":[14,18],"grow":[15],"in":[16,181,195],"scope,":[17],"become":[19],"dependency-bearing":[20,85],"artifacts":[21],"whose":[22],"identities,":[23],"versions,":[24],"and":[25,35,61,81,95,99,106,120,125,144,156,161,189,219],"provenance":[26],"remain":[27],"implicit.":[28],"This":[29],"opacity":[30],"already":[31],"causes":[32],"duplicated":[33],"dependencies":[34,146],"inconsistent":[36],"installations,":[37],"exposing":[38],"a":[39,174],"gap":[40],"that":[41,172],"dependency":[42,59,79,96,139,154,163,207],"management":[43],"has":[44],"to":[46,55,76,112,197],"close.":[47],"We":[48,128,169],"introduce":[49],"Skill":[51],"Supply":[52],"Chains":[53],"(ASSCs)":[54],"characterize":[56],"mixed":[57],"skill-package-service":[58],"graphs":[60,97,140,155],"help":[62],"close":[63],"this":[64],"gap.":[65],"Borrowing":[66],"from":[67],"Software":[68],"Bill":[69],"of":[70],"Materials":[71],"(SBOMs),":[72],"we":[73,117,187,204],"design":[74],"SkillDepAnalyzer":[75,91,111],"capture":[77],"natural-language":[78],"evidence":[80],"model":[82],"artifacts.":[86],"On":[87],"the":[88],"SKILL-DEP":[89],"benchmark,":[90],"recovers":[92],"skill":[93,133,151,162,175,216,223],"metadata":[94,134],"accurately":[98],"comprehensively,":[100],"substantially":[101],"outperforming":[102],"an":[103],"LLM-based":[104],"baseline":[105],"package-centric":[107],"SBOM":[108],"tools.":[109],"Applying":[110],"over":[113],"1.43":[114],"million":[115],"skills,":[116],"obtain":[118],"ASSCs":[119,196],"explore":[121],"their":[122,198],"structural":[123,131],"diversity":[124],"security":[126],"signals.":[127],"find":[129,171],"four":[130],"patterns:":[132],"is":[135],"activation-ready":[136],"but":[137],"governance-poor;":[138],"span":[141],"skill,":[142],"package,":[143],"service":[145],"with":[147],"concentrated":[148],"reuse;":[149],"recursive":[150],"reuse":[152],"expands":[153],"creates":[157],"hidden":[158],"inventory;":[160],"clusters":[164],"form":[165],"around":[166],"related":[167],"workflows.":[168],"also":[170],"inspecting":[173],"alone":[176],"misses":[177],"security-relevant":[178],"signals":[179],"hiding":[180],"its":[182],"dependencies.":[183],"By":[184],"analyzing":[185],"ASSCs,":[186],"identify":[188],"report":[190],"known":[191],"malicious":[192],"persisting":[194],"developers.":[199,224],"Based":[200],"on":[201],"these":[202],"findings,":[203],"recommend":[205],"typed":[206],"manifests,":[208],"first-class":[209],"dependency-cluster":[210],"management,":[211],"risk-warning":[212],"audit":[213],"commands":[214],"infrastructure":[217],"maintainers,":[218],"lockfile-like":[220],"records":[221]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-07-03T00:00:00"}