AI
New Tool Detects Hidden Code Clones Across 2 Million AI Agent Skills
Researchers develop a multi-modal clone detector that uncovers widespread reuse and copying in LLM agent skill repositories, revealing that two-thirds of analyzed skills are superseded by higher-quality versions.
The Problem with Invisible Reuse#
Large language model agent skills—reusable packages that extend LLM capabilities—are proliferating across public repositories. Over two million of these skills now exist, yet no systematic method exists to track how they're being copied, adapted, or reused. Current clone detection tools analyze each skill's components in isolation, missing the hidden links that span across different types of content.
How SkillReuse Works#
Researchers have introduced SkillReuse, a multi-modal clone detector designed to catch these hidden relationships. The tool combines three separate analytical channels: lexical matching of YAML metadata, natural-language analysis of prose instructions, and code structure comparison. Rather than treating each channel independently, the system fuses these signals using logistic regression to generate both a numerical clone score and interpretable labels describing the type of reuse involved.
The team also created SkillReuse-Bench, a manually annotated dataset of 300 skill pairs representing different reuse patterns—from exact duplicates to renamed copies, partial adaptations, and semantically equivalent variants. Testing on this benchmark, SkillReuse achieved an F1 score of 0.939 with 95.2% precision, substantially outperforming simpler approaches like TF-IDF and delivering 4.2 times better recall than MinHash on the hardest category of semantic clones.
Ecosystem-Wide Findings#
When applied to 137,470 skills that met quality filters, SkillReuse identified 1.06 million clone pairs spanning nearly 67% of all analyzed skills. The vast majority—95.3%—of these pairs cross author boundaries, indicating widespread copying rather than intentional maintenance. Among skills grouped by name-based clone families, two-thirds have been superseded by higher-quality successors.
The system also revealed a security dimension: when researchers traced 938 security-relevant skills through the clone graph, they surfaced 16,587 additional connections spanning 6,376 related skills—links that conventional per-skill security scanners would have missed entirely.
