83% of Agent Skills have no license

We index every public SKILL.md we can find, and each one carries a license field in its frontmatter if the author chose to fill it in. Most did not.

On 10 October 2026, across 1,081,266 public skills:

	Skills	Share
No license at all	901,653	83.4%
Declares something	179,613	16.6%

That ratio has not moved. We counted the same thing three weeks earlier at 860,246 skills and got 83.4% then too. It is not an artifact of when we sampled or which repositories we had reached. It is what the ecosystem looks like.

What the 16.6% actually chose

License	Skills	Share of all public skills
MIT	106,641	9.86%
Apache-2.0	36,336	3.36%
CC-BY-4.0	11,480	1.06%
Apache 2.0	5,997	0.55%
MIT license	1,624	0.15%
BSD-3-Clause license	1,023	0.09%

Look at rows four and five. Apache 2.0 is a different stored value from Apache-2.0, and MIT license is a different stored value from MIT. Same license, different string, counted separately.

That is the second finding, and for anyone building tooling it is the more annoying one. The field is free text. It is not validated against SPDX identifiers, so a script that checks whether a skill is MIT has to normalise before it can compare. The long tail includes entries like Complete terms in LICENSE.txt, Proprietary. LICENSE.txt has complete terms, Unknown and Unspecified, each of which is a human telling you to go read something else.

Why this matters more for skills than for most code

A skill is instructions an agent follows. People install them by copying files into a project, often a work project, usually without reading the frontmatter.

Code published with no license is under default copyright. The author keeps every right, and nobody else has permission to copy, modify or redistribute it. Putting a repository on the public internet does not grant a license, and a permissive culture around sharing does not either. So the honest reading of the table above is that most Agent Skills currently cannot be redistributed by anyone except their author, whatever everyone’s intent was.

For a developer trying something out, that is theoretical. For anyone doing procurement, vendoring skills into a product, or answering a compliance questionnaire about what is in their repository, it is not.

Where the numbers come from

Every skill in the registry is pinned to a source repository and a commit, so these counts are auditable rather than asserted. The method:

• Population: every skill with is_public = 1 at the time of the query, 1,081,266 rows. Byte-identical duplicates are already excluded, so no fork inflates the count.
• Declared: license is present and not an empty or whitespace-only string. No normalisation, no guessing from a LICENSE file in the repository, no inference. If the author wrote it in the frontmatter, it counts; otherwise it does not.
• Provenance: 1,081,231 of those rows carry a source repository, so all but 35 can be traced back to where they came from.

Counted 10 October 2026. The live totals sit on the stats page and move as skills are published.

One thing the method deliberately does not do is read the repository’s LICENSE file. A repo-level license may well cover a skill inside it, and for many of the 901,653 it probably does. What we are measuring is narrower and more useful: whether the skill itself tells an agent, or a script, or a person reading one file, what the terms are. Nothing automated can answer that question today for five skills out of six.

If you publish skills

Add one line:

---
name: my-skill
description: What it does, and when to use it.
license: MIT
---

Use an SPDX identifier rather than prose, so tools can read it. npx skillmds lint reports a missing license as SK011 before you publish, and the format reference explains the rule.

It costs nothing and it is the difference between a skill someone can use at work and a skill their legal team says no to.