🛠️ skillshare v0.15.2 Release Notes

Release date: 2026-02-22

TL;DR

v0.15.2 is a patch release with one new feature, a performance improvement, and several reliability fixes:

Hub audit enrichment — hub index --audit embeds risk scores so teammates can assess skill safety before installing
Parallel audit scanning — audit scans run concurrently (up to 8 workers) for faster index generation
Init timing fix — initial commit deferred to after skill installation, preventing first-pull errors
Auth error UX — push/pull auth failures now show platform-specific, actionable remediation hints
Locale-safe git parsing — LC_ALL=C prevents failures on non-English systems

What's New

1) `--audit` flag for `hub index`

Enrich your hub index with per-skill security risk scores:

skillshare hub index --audit

Each skill entry gains riskScore (0-100), riskLabel (clean/low/medium/high/critical), and auditedAt fields. When browsing the index via search --hub, risk badges are displayed alongside each result:

  my-skill                      [clean]
    A useful skill for formatting

Key details:

Uses the existing 25-rule audit engine (same as skillshare audit)
Scans run in parallel (up to 8 concurrent workers) for fast index generation
Schema stays at v1 — audit fields are optional and omitted when --audit is not used
Works with both --full and default modes
Combine with --output to write enriched index to a specific path

Bug Fixes

Init timing causes "Local changes detected" on first pull

skillshare init previously committed .gitignore immediately, but skill installation happened afterward — leaving skill files uncommitted. This caused "Local changes detected" errors on the first pull from another machine.

Now a single commit is created after all files (.gitignore + skills) are in place. All scenarios are covered:

Fresh init with/without skill → one clean commit
init --remote with empty remote → commit then push
init --remote with existing remote → reset to remote; no extra commit
Re-running init --remote on existing config → proper error handling with timeout

Auth errors show wrong remediation advice

When push or pull failed due to authentication (wrong/expired/missing token), the CLI misleadingly suggested "try skillshare pull first" as a remedy. Now auth errors are detected and show actionable options:

Switch to SSH URL
Set token env var (GITHUB_TOKEN, GITLAB_TOKEN, BITBUCKET_TOKEN, SKILLSHARE_GIT_TOKEN)
Configure git credential helper
Platform-specific syntax: PowerShell $env: on Windows, export on Unix
Link to docs with required token scopes per platform

Skill version double prefix

SKILL.md frontmatter containing version: v0.15.0 previously displayed as vv0.15.0 because callers also prepended "v". The v prefix is now normalized at the source.

Git output parsing fails on non-English systems

Git localizes its output based on LANG/LC_ALL environment variables. On Chinese, Japanese, or German systems, messages like "nothing to commit" appear in the local language, causing commitSourceFiles to misinterpret the output as an error. Similarly, isAuthError in push/pull could fail to detect auth failures.

Now LC_ALL=C is set in the environment for all git commands that parse output:

gitPush — auth error and remote error detection
commitSourceFiles — "nothing to commit" detection
remoteFetchEnv — all remote fetch operations in init --remote

Documentation

Added required token scopes per platform (GitLab, Bitbucket) to environment-variables reference
Rewrote auth error section in common-errors troubleshooting guide with token env var options and Windows syntax
Clarified interactive setup flow in init command docs and cross-machine sync guide

Upgrading

# Homebrew
brew upgrade skillshare

# Go install
go install github.com/runkids/skillshare/cmd/skillshare@v0.15.2

# Self-upgrade
skillshare upgrade

Changelog

d1d528f feat: add --audit flag to hub index for security risk enrichment
83d13f6 feat: add platform-specific token setup hints for auth errors
506b60a fix init remote flow and clarify interactive setup docs
593bcab fix: defer git initial commit to after skill installation
311c9ad fix: force English git output and parallelize hub audit scanning
ba852f6 fix: show auth hints instead of "pull first" on push/pull auth failure
ce5ba14 fix: strip "v" prefix from skill version to prevent "vv" display
f6087ac refactor: use plain bool for BuildIndex auditSkills parameter

runkids/skillshare v0.15.2 on GitHub