Look at what trended on GitHub today and the list reads oddly. There are no compilers at the top, no databases, no frameworks. What is there are repositories whose contents are mostly prose: folders of markdown with a little YAML in front, occasionally a script behind it.
Star velocity is a bad metric and a good signal. Bad, because it measures attention rather than use, and it is trivially gameable. Good, because it tells you what a large number of developers are looking at on a given day — and the composition of that list has changed.
Markdown became executable
The format is roughly this. A folder. A `SKILL.md` describing what the skill does and when an agent should reach for it. Some frontmatter for the name and description. Optional scripts or reference files the agent reads when it needs them. The agent scans the description, decides it is relevant, and loads the body. That is the whole protocol.
It is worth pausing on how strange that is. For thirty years the unit of software distribution was a compiled artifact or a package with a dependency graph. Now a meaningful amount of capability ships as prose — and the prose is not documentation about the behaviour, it is the behaviour. Write "always check the CSV for a header row before parsing" in a skill file and you have shipped a bug fix. Write the wrong thing and you have shipped a bug.
Why it spreads so fast
Four reasons, and all of them are about friction.
No build system. No version compatibility matrix. No transitive dependencies to resolve. A skill is forkable in a browser and reviewable in a diff, which is more than can be said for most of what lands in a `node_modules` folder.
The audience reads the source. An agent does not need an SDK, a type stub or a changelog. It reads the file.
And the economics are unusually flat. Anyone who has done a task well once can write down how they did it, and that artifact is immediately useful to an agent with no packaging step in between. The distance between "I know how to do this" and "this is distributable" has collapsed to the length of a text file.
The part nobody is auditing
Which brings us to the problem, and it is a serious one.
Installing a third-party skill is granting an agent a set of instructions you did not write. That is prompt injection with a package name and a star count. A skill can tell an agent to read files it should not read, to summarise credentials into an output, to prefer one library over another for reasons that are commercial rather than technical, or simply to be confidently wrong in a specific direction. None of that is malware by any scanner's definition. It is a sentence in a markdown file.
The ecosystem has no equivalent of `npm audit`. There is no advisory database for "this skill instructs the agent to exfiltrate environment variables". There is no lockfile semantics for prose, and pinning a commit helps only if you were disciplined enough to pin.
The strange good news
Here is the twist that makes this different from the usual supply-chain lament: the review surface has become small enough to actually review.
A typical JavaScript package pulls in hundreds of files you will never open. A skill is usually one file, and reading it takes two minutes. The artifact that can compromise your agent is legible to a human being in a single sitting — the opposite of the situation we spent the last decade complaining about.
The review burden is not the bottleneck. The habit is. Most people install a trending repository the way they install a package: because it is trending.
What to do
Treat skills as code for permissions, because that is what they are: pinned by commit, sandboxed to the directories they actually need, and read before installation — the whole file, not the README. Be suspicious of a skill whose instructions are vague about why it wants something, and of any skill that asks for broad filesystem or network access it cannot justify in one sentence.
And notice the shift while it is happening. The unit of open-source collaboration is changing shape, from a library you call to a set of instructions an agent follows. That is a genuinely new kind of software artifact, and the ecosystem around it — review norms, provenance, revocation — has not been built yet. The repositories at the top of the trending page today are, whether they meant to or not, arguing for it.
