Disclosure: I work on Skillselion, an independent directory of Claude Code, Codex and Cursor extensions, not affiliated with Anthropic, OpenAI or Cursor. This post is built entirely on a public dataset we published and froze, so you can check every number yourself.
We expected a graveyard. We read the last-push date of the repository behind every listing in our catalog, 79,848 of them, and got the opposite result. Weight every listing by its installs and take the median: the code behind it was pushed six days before the census date. 79,875,458 installs, 48.5% of all installs in the census, sit on repositories pushed within the previous seven days. 66.8% sit on code pushed within the previous month. The unweighted median listing is 26 days old, so the code people actually install is fresher than the catalog at large.
The full study, with the frozen numbers and the CSV, is The Agent Skill Maintenance Census.
Half the catalog idles, and almost nobody installs it
The tail behaves nothing like the core.
| Staleness cutoff | Share of dated listings | Share of installs |
|---|---|---|
| No push in 30 days | 47.9% | 23.8% |
| No push in 90 days | 28.2% | 2.6% |
| No push in 180 days | 9.5% | 1.0% |
Idle code exists in bulk, but almost nobody installs it. At the 90 day cutoff more than a quarter of dated listings qualifies as quiet, and all of it together accounts for 2.6% of installs.
The two largest stale listings in the census are humanizer-zh at 43,355 installs and 204 days, and design-doc-mermaid at 32,625 installs and 225 days. Both are small next to anything in the live core of the skills catalog.
Three listings out of 75,800 went a year without a push
That is not a typo. Exactly three, and between them they hold zero installs.
This is a young distribution format. It took off in late 2025 and has not existed long enough to decay. The honest reading cuts both ways: nothing here has survived long enough to prove it lasts either. The 180 day bucket, 9.5% of dated listings today, is the number worth watching edition over edition.
The uncomfortable one: the risky code is the fresh code
If you assume unmaintained code is where the security risk lives, this dataset disagrees.
Cross this census with our security census and the overlap of listings that are stale past 180 days, shell-capable, and never audited by any provider comes to 208 listings holding 7,335 installs. The security census's full audit blind spot holds 15,858,667 installs.
So more than 99% of the unaudited, shell-capable install mass sits on actively maintained code. Waiting for a repository to go quiet before you worry about it will not find the exposure, because almost none of it is there.
If you audit agent extensions, that reorders the queue: sort by install count and permission surface, not by last commit date. The security category hub lists the tooling side of that job.
Does a recent push mean a skill is safe?
No. Two limits, stated because they change how you should cite this.
pushed_at is repository level. A monorepo holding fifty skills refreshes all fifty with one commit, so per-skill freshness is overstated wherever large multi-skill repositories dominate. Staleness stays reliable in the other direction: an untouched repository is untouched for every skill inside it.
And a push timestamp measures activity, not quality or safety. All it tells you is that someone was in the repository recently.
75,800 listings, 94.9% of the catalog and 90.6% of installs, carry a usable date and form the denominator for every staleness figure here. 259 rows report an epoch-zero timestamp, a registry artifact, and are excluded along with the remaining undated rows.
The rest of the series
Each of these is a frozen edition with its own downloadable dataset:
- The Agent Skill Security Census covers who audits agent skills and what the five providers disagree about.
- The Agent Use-Case Census covers what people actually point agents at.
- The Agent Skill Clone Census covers duplication and forks across the catalog.
- The Agent Economy Census covers publisher concentration and the install Gini.
- The State of AI Agent Skills 2026 carries the live totals rather than a frozen edition.
- Everything else sits on the research index.
If you would rather browse than read, the MCP servers and marketplaces listings are the two ranked shortlists worth starting from, and the AI and agents category is the closest hub to this dataset.
Sources: live catalog, refreshed daily from skills.sh, GitHub and MCP registries, ranked by real installs.
The census CSV is CC BY 4.0. Numbers are frozen to 2026-08-12, so anything you quote stays checkable. The full edition, the per-cutoff tables and the CSV are at The Agent Skill Maintenance Census.
Skillselion Agent Skill Maintenance Census, August 2026
https://skillselion.com/research/agent-skill-maintenance-census-2026-08
One thing I want to hear from this comment section: when you vet an agent skill before installing it, do you look at the last commit date at all? If yes, what does it change for you?
Top comments (0)