State of Agent Skills: In 12 Nights, 1 in 9 Watched Skills Changed at Least Once

Skill Harbor now lists 2,762 skills. On the night of October 22 to 23, we checked 2,681 install files and held a fingerprint for 2,669 of the listed skills, 96.6 percent of the catalogue. The nightly check has been scheduled since October 3. Each night it re-fetches those files and compares their SHA-256 hash to the fingerprint we reviewed. When the bytes differ, the listing is flagged until a human-supervised triage decides what happened.

This edition covers October 3 to 23, three weeks, not a full month. The clean numbers below cover the 12 nights from October 12 to 23, when every detected change was written to an append-only journal before any triage decision. The first week was a calibration week, and we say so below instead of pretending it was the same measurement.

The headline numbers

• 2,669 skills fingerprinted on October 23, out of 2,762 listed. 87 listed skills still have no snapshot: 34 have no SKILL.md file to fetch, 36 are ambiguous (several candidate files, no safe choice), and 17 fail to fetch, including the 11 Telep listings whose repository went private.
• 486 file-change events in 12 nights (October 12 to 23), across 296 listings, 100 sellers, and 104 repositories or hosts.
• 40.5 changes per night on average, ranging from 22 to 57. On nights where the checked count is preserved, that is 0.8 to 2.5 percent of checked files per night.
• 296 listings changed at least once in 12 nights: about 1 in 9 watched listings. 200 changed exactly once, 96 changed at least twice (32 percent of all changers), and 21 changed four times or more.
• For a file that changed again, the median gap between two changes was 2.0 days (mean 2.6 days, 188 gaps across 98 files). This is not the median lifetime of a skill. Most watched skills did not change at all in the window. It says: repeat changers are not occasional. They move every couple of days.
• Final disposition of the 486 events, as recorded on October 24: 324 re-baselined as benign (66.7 percent), 125 followed by a regenerated install prompt (25.7 percent), 35 left under a visible "pending verification" warning (7.2 percent), 2 still pending (0.4 percent). These are final dispositions, updated when a later train regenerated a prompt. They are not the split decided on triage night itself.

Changes travel in packs

The same pattern as week one, now measured over 12 nights. The most active sources were:

• coreyhaines31/marketingskills: 45 events
• dontbesilent2025/dbskill: 40 events
• heygen-com/hyperframes: 32 events
• Weaxs/stock-analysis-plugin: 24 events
• himself65/finance-skills: 20 events
• leonxlnx/taste-skill: 17 events
• software-mansion/argent: 17 events
• earthtojake/text-to-cad: 16 events
• expo/skills: 15 events

If you install five skills from one of these repositories, they tend to move on the same night, and to break or improve together. The single most restless listing was Maritime (maritime.sh): 12 changes in 12 nights, one per night. Next came Answer Me with HTML (9 changes) and Yomiyasu (7 changes). Grandet API Price Finder produced 6 events in four days, October 20 to 23, across its two files, including a rollback from build 20261018b to 20261017.

By catalogue category, in absolute events: Developer tools 77 events across 47 listings, Marketing 51 across 31, Trading 41 across 22, Design 35 across 22, Productivity 27 across 13, Finance 23 across 23, Writing 21 across only 6 listings, and Engineering 21 across 8. Writing and Engineering look quiet by count and restless by repetition: few listings, each moving several times. Catalogue categories are messy (several near-synonyms), so treat the ranking as a shape, not a precise league table.

One night, dissected: October 19

On October 19, 57 files changed. The triage that morning auto re-baselined 32 routine changes and flagged 25 for a human look. The 25 included: the Leonxlnx design skills, several of which had become stubs pointing elsewhere; the Firecrawl lead generation and lead research skills, rewritten around a new system; the Three.js skills, rewritten for a new release and rendering path; and a database skill whose new version changed how it is triggered. Each of those would have made the old install prompt misleading. The routine 32, by contrast, were prose, version bumps, and small fixes that left the prompt faithful.

Other non-routine changes in the window, each dated:

• October 20: McClipFace 2.9.1 removed an opt-in step and changed its purchase flow. It was flagged for a human look, not auto re-baselined.
• October 21: a Firebase hosting skill gained new shell commands and a secrets command piped through shell; a Google BigQuery skill reintroduced a mandatory attribution section that contradicted the prompt on its page. Both were flagged.
• October 23: the Hallmark skill jumped from version 1.1.0 to 2.0.0 with about 87 percent of its content rewritten, and Grandet rolled back a build. Both were flagged, and Grandet's second file was still pending at the cutoff.
• October 11: a security gateway skill was massively rewritten, McClipFace gained a new deal-discovery feature, and a Chrome browsing skill had its secret-handling guardrails rewritten. All three were flagged.

Gone, and still listed

Four listings are now unlisted: MuseFi, Manjangilchi, the Shipshitdev fullstack workspace initializer, and the Terrylica calendar event manager. The 11 Telep listings are a different case: still listed, but their repository is private, so no snapshot can be fetched and no change can be detected. That is a blind spot, and it is counted in the 87 uncovered listings above, not hidden.

On the morning of October 24, only two listings still carried a "pending verification" flag (ElevenLabs Music and Grandet), only one still carried a "remote content changed" flag (Grandet), and zero listings were suspended.

The honesty section

Four things we got wrong, missed, or cannot prove cleanly. They stay in the published version if this draft is published.

1. The night we cried wolf, October 9. The checker raised 460 flags. 416 were our own fault: baselines created on October 8 stored GitHub web pages instead of raw files, so every file "changed" against its own baseline. Real upstream changes that night: 44, of which 1 needed a human look (McClipFace's consent model). A change count without a false-alarm rate is marketing, not measurement. The 12-night series above starts after that migration, which is why we trust it more than the first week.

1. The first week is not a clean series. Monitoring was scheduled October 3 in a ghost mode: triage noted what it would have re-baselined without writing anything. The very first run, on October 3, produced no count at all: it crashed on its first D1 query, because that query pulled the full content of 1,399 snapshots, about 278 MB, past what the D1 REST API can return. It was repaired that same morning (bulk read without content, old content fetched one row at a time only on a hash mismatch), and the first successful nightly check was October 4. The ghost bilan counted 1,945 would-be re-baselines over seven nights, dominated by fetch noise. Individual nights we can verify: October 4, 99 changes (cumulative since snapshot creation, not a 24-hour rate); October 6 triage, 32 changes; October 7, 4 upstream changes flagged; October 8, 51 changes triaged; October 10, 90 changes out of 2,247 checked, 4.0 percent, of which 74 routine and 16 needing a human look. The per-night count for October 5 is not preserved separately in the log files we found, so we do not invent it, and we do not present a single 21-night total as if the method had been constant.

1. The detector suspended the same listing twice, and both times it was wrong. On October 14 and again on October 20, the automatic red-line scan suspended coreyhaines31-attribution for an "exfiltration" pattern. Both suspensions were lifted by Max after review: the flagged passage describes first-party analytics, an anonymous analytics identifier passed to the user's own webhook, with an explicit warning never to pass personal identifiers to a third party. It is a lexical false positive, and it will predictably recur at the next upstream bump until the detector itself is fixed. Zero suspensions were active at the cutoff.

1. October 11 triage ran late. The 03:37 triage failed on a Cloudflare D1 quota, and the catch-up ran at about 07:47 after the Workers Paid upgrade. It processed 24 changes (12 auto re-baselined, 12 flagged). Nothing was lost, but that morning's report was late, and the quota failure is part of the record.

Two limits of the method itself. First, a snapshot is one file per listing, the file named in the install prompt. A change flag means the bytes differ. It does not say whether the change matters, and it says nothing about the rest of the repository. Second, the catalogue and the coverage changed during the window: coverage grew from about 2,294 snapshots on October 12 to 2,681 on October 23, and 152 new snapshots were created on October 20 alone as new listings arrived. The 12-night numbers are therefore a moving cohort, not a fixed panel.

Why this matters if you install skills

An install prompt written last month describes last month's files. In 12 nights, 1 in 9 watched skills moved, and a third of the movers moved again within days. That is why every Skill Harbor install prompt carries the fingerprint of the reviewed version, why your agent is told to stop and ask you if the file no longer matches, and why listings whose test could not be completed say so on their face. The ecosystem is not a library. It is a river. We watch it so the page you read describes the water as it is today.

What comes next

The watch continues nightly. The next edition should cover a full month on a stable method, and will be able to say whether the 2.0-day repeat gap holds, whether Maritime's daily rhythm is an outlier or a class of its own, and whether the Telep blind spot grows or shrinks. If a number here ever turns out to be wrong, we will correct it in the open, the same way we handle listings.

---

🤍 0