What's this about?
The authors reconstruct 2,193,119 GitHub skill adoptions and report copies rarely update with their source. Ranking repositories by copy influence yields better audit targeting than stars in their retrospective analysis. “Adoptions” are copy events, not unique users.
What exactly is software supply chain?
The path by which instructions and code move from their original author into a tool you run. Copies can lose version and update information.
What's the community saying / why does it matter?
HF: 5 upvotes; no substantive discussion collected. The result favors traceable, versioned distribution; it does not establish that every copied skill is malicious.