skillshare v0.11.4 Release Notes

Release date: 2026-02-11

TL;DR

v0.11.4 makes the audit system customizable and less noisy:

1. Audit rules are now externalized to YAML — override, extend, or disable rules per-project
2. HIGH findings downgraded to warnings — only CRITICAL blocks install
3. Built-in skill is opt-in — no longer auto-installed on init/upgrade
4. Playground ships audit demos — enter sandbox and explore audit immediately

Why These Changes

Audit rules were too rigid

v0.11.0 shipped a fixed set of built-in audit rules. Users couldn't suppress false positives (e.g., curl to internal artifact hosts), couldn't add team-specific policies (e.g., "no TODO without a ticket"), and couldn't adjust severity to match their risk tolerance. Externalizing rules to audit-rules.yaml with a three-layer merge (built-in → global → project) solves all three.

HIGH findings were too aggressive

Blocking install on HIGH findings caused friction for legitimate skills that happen to use sudo or fetch external URLs. Now only CRITICAL findings (prompt injection, secret exfiltration) block install. HIGH and MEDIUM are shown as warnings — visible but non-blocking.

Built-in skill added unwanted context

The default built-in skill was installed on every init and upgrade, adding to the AI context window even when users didn't want it. Making it opt-in (--skill) respects the principle of minimal default footprint.

New Features

Customizable audit rules (audit-rules.yaml)

Security rules are now externalized to YAML files that merge on top of built-in rules:

built-in rules (embedded)
  → ~/.config/skillshare/audit-rules.yaml   (global overrides)
    → .skillshare/audit-rules.yaml          (project overrides)

Each layer can:

• Add new rules with custom id, severity, regex, and optional exclude pattern
• Override built-in rules by reusing the same id (change severity, message, or regex)
• Disable rules with enabled: false

Example — allowlist internal hosts and add a team policy:

rules:
  # Override: allowlist internal artifact hosts
  - id: suspicious-fetch-0
    severity: MEDIUM
    pattern: suspicious-fetch
    message: "External URL used in command context"
    regex: '(?i)(curl|wget)\s+https?://'
    exclude: '(?i)https?://(localhost|artifacts\.company\.internal)'

  # Custom: require ticket for TODOs
  - id: team-todo-policy
    severity: MEDIUM
    pattern: team-policy
    message: "TODO/FIXME requires a tracking ticket"
    regex: '(?i)\b(TODO|FIXME)\b'

  # Disable: suppress system-writes noise
  - id: system-writes-0
    enabled: false

CLI: skillshare audit --init-rules to scaffold a starter file.

Web UI improvements

• New Audit Rules page — create, edit, and save audit-rules.yaml directly from the dashboard with syntax-highlighted YAML editing. Supports both global and project modes.
• Audit page — new "Custom Rules" button links to Audit Rules page; toast messages now distinguish between critical issues and warnings.
• Dashboard — Security Audit section now shows separate badges for critical (red) and warning (yellow) findings instead of a single "issues" count. Label changed from "Failed" to "Critical".
• Log page — filter by time range (1h / 24h / 7d / 30d), status (ok / error / partial / blocked), and command keyword. Empty state messages distinguish between "no entries yet" and "no matching entries".
• Custom dropdown component — HandSelect rewritten from native <select> to a custom accessible dropdown with keyboard navigation (arrow keys, Enter, Escape), scroll-into-view, and outside-click-to-close. Used across Skills sort and Log filters.
• Log API — GET /api/log now accepts since, status, and command query parameters for server-side filtering; response includes total_all for unfiltered count.

Docker playground audit demo

The playground now ships with pre-loaded demo skills and custom rules so users can explore audit immediately:

Global audit-rules.yaml demonstrates: hardcoded token detection, suspicious-fetch allowlist override, rule disabling.
Project audit-rules.yaml demonstrates: project-specific TODO policy.

make sandbox-up && make sandbox-shell
skillshare audit            # global scan — see CRITICAL/HIGH/MEDIUM findings
skillshare-ui               # web dashboard → Audit & Audit Rules pages
cd ~/demo-project
skillshare audit            # project scan with custom rules

Important Changes

• Built-in skill is opt-in — skillshare init and skillshare upgrade no longer install the built-in skill by default. Use --skill to include it.
• HIGH findings are warnings — only CRITICAL findings block skillshare install. HIGH and MEDIUM findings are displayed as warnings but do not prevent installation.
• Test isolation — integration tests are now split into offline (!online) and online (online) build tags. make test runs only offline tests; make test-docker-online runs network-dependent tests.

Upgrade Notes

No breaking changes. Recommended post-upgrade:

skillshare audit                  # see findings with new severity classification
skillshare audit --init-rules     # scaffold audit-rules.yaml if you want customization

Changelog

• 927bad7 feat: add audit rules Web UI page with create/edit support
• 84ba168 feat: add log filtering, improve log UX, and custom dropdown
• 2c98284 feat: classify HIGH audit findings as warnings and refresh docs/playground
• fbcec80 feat: externalize audit rules to YAML with user customization
• 348102d feat: make built-in skill opt-in for init and upgrade