Helps measure the concentration of trust roots in a skill's attestation graph — identifying monoculture risk where a single compromised root invalidates an entire chain that appears to have multiple validators.
Helps identify when a skill's trust chain is structurally fragile — not because individual links are weak, but because all paths converge on a single root that one compromise can invalidate.
A skill with five attestation badges looks more trustworthy than a skill with one. But if four of those five badges trace back through the same root attestor, the effective trust diversity is closer to two than to five. The appearance of multiple independent validators is real; the independence is not.
This is a topology problem, not a cryptography problem. A trust graph where all paths converge on a single root is not a distributed trust system — it's a hub-and-spoke system wearing the visual appearance of a mesh. A hub-and-spoke system has all the failure properties of centralized trust: compromise the hub, and every spoke-rooted badge becomes invalid simultaneously.
The risk is not hypothetical. Self-attesting roots — where the publisher is also the root attestor, or where multiple attestation badges trace back to a single organization — are common in ecosystems where attestation is new and infrastructure is thin. A skill from a well-known publisher that has also reviewed its own dependencies through affiliated validators presents structural fragility even if every individual attestation is cryptographically correct.
Measuring this requires looking at the full trust graph, not just the badges at the leaves.
This analyzer examines attestation root diversity across five dimensions:
Input: Provide one of:
Output: A root diversity report containing:
Input: Analyze attestation root diversity for workflow-automator skill
🌐 ATTESTATION ROOT DIVERSITY ANALYSIS
Skill: workflow-automator
Attestation badges: 7
Audit timestamp: 2025-04-20T14:00:00Z
Trust graph structure:
Badge A → Validator-1 → Root-Alpha (publisher-org)
Badge B → Validator-2 → Root-Alpha (publisher-org)
Badge C → Validator-3 → Root-Alpha (publisher-org)
Badge D → Validator-4 → Root-Beta (third-party)
Badge E → Validator-5 → Root-Beta (third-party)
Badge F → Validator-6 → Root-Alpha (publisher-org) ← affiliate
Badge G → Validator-7 → Root-Gamma (community)
Root concentration analysis:
Root-Alpha (publisher-org): 4/7 paths (57%) → publisher + 3 affiliated validators
Root-Beta (third-party): 2/7 paths (29%)
Root-Gamma (community): 1/7 paths (14%)
Herfindahl index: 0.57² + 0.29² + 0.14² = 0.42
(0 = perfect distribution, 1 = single root)
Classification: CONCENTRATED (threshold: >0.33 = concentrated)
Self-attestation: ⚠️ DETECTED
Root-Alpha is publisher-org — publisher attests to its own skill
3 of 7 badges trace directly to publisher-controlled validators
Organizational diversity:
Distinct organizations: 3 (publisher-org, third-party, community)
Effective independent: 2 (publisher-org counts as 1 despite 4 paths)
Effective validator count: 2.4 (weighted by independence)
Structural fragility:
If Root-Alpha were compromised: 4/7 badges (57%) invalidated
Residual trust: Root-Beta (29%) + Root-Gamma (14%) = 43%
Diversity verdict: CONCENTRATED
7 badges with 3 roots, but effective independence is 2.4 validators.
Root-Alpha concentration exceeds recommended threshold for high-impact
skills. Self-attestation by publisher reduces independence further.
Recommended actions:
1. Require minimum 2 non-publisher roots for full DISTRIBUTED status
2. Disclose self-attestation presence in badge display
3. Weight Root-Alpha badges at 0.5× for concentration-aware scoring
4. Target Root-Gamma growth to reduce Alpha concentration below 0.33
Root diversity analysis requires access to the full attestation graph, including the organizational relationships between validators — data that many current marketplaces do not expose. Where only the leaf badges are visible and root relationships must be inferred, the analysis is necessarily approximate. Organizational independence is difficult to verify programmatically: two organizations with different names may share effective control. The Herfindahl-based concentration measure is a useful heuristic, not a definitive security assessment — the appropriate threshold depends on the risk profile of the capability being attested. A concentrated attestation graph is a structural concern, not a confirmation of compromise; it means the trust infrastructure is more fragile, not that it has already failed.