🛡️ skillshare v0.16.11 Release Notes

Release date: 2026-03-05

TL;DR

v0.16.11 adds supply-chain trust verification, hardcoded secret detection, and web UI streaming — a new metadata analyzer detects publisher impersonation, 10 new rules catch inline API keys and tokens, doctor gains file hash integrity checks, and the web UI streams all long-running operations in real time:

1. Metadata analyzer — detects publisher mismatch (HIGH) and authority language (MEDIUM) in SKILL.md
2. Hardcoded secret detection — 10 new rules detect Google, AWS, GitHub, Slack, OpenAI, Anthropic, Stripe keys, private key blocks, and generic secret assignments
3. Doctor integrity check — verifies file hashes against .skillshare-meta.json
4. Web UI SSE streaming — all long-running operations (audit, update, check, diff) stream results via SSE
5. Virtualized scrolling — audit results and diff items use virtual scrolling for smooth large-dataset performance
6. SSL error guidance — actionable options when git clone fails due to certificate issues

No breaking changes. Drop-in upgrade from v0.16.10.

Supply-Chain Trust Verification

The problem

A skill can claim to be "Official Claude Helper by Anthropic" in its SKILL.md description, but actually be published by an unknown user. The existing audit engine catches code-level threats (injection, exfiltration), but not metadata-level social engineering.

Metadata analyzer

The new metadata analyzer (skill scope) cross-references SKILL.md frontmatter against .skillshare-meta.json:

Rule A: publisher-mismatch (HIGH)

Detects when SKILL.md claims an organization that doesn't match the actual repo owner:

HIGH  publisher-mismatch  skill claims origin "Anthropic" but sourced from "evil-fork"

Supports patterns: from X, by X, made by X, created by X, published by X, maintained by X, and @handle mentions. Substring matches are allowed (e.g., claiming "vercel" when owner is "vercel-labs" passes).

Rule B: authority-language (MEDIUM)

Detects authority words ("official", "verified", "trusted", "authorized", "endorsed", "certified") from unrecognized sources:

MEDIUM  authority-language  skill uses authority language (official, verified) but source is unverified

Well-known organizations (Anthropic, OpenAI, Google, Microsoft, Vercel, etc.) are allowed. Local skills (no repo URL) are skipped.

Both rules are disable-able via audit-rules.yaml:

skillshare audit rules disable publisher-mismatch
skillshare audit rules disable authority-language

# Runs by default with all analyzers
skillshare audit

# Run metadata analyzer only
skillshare audit --analyzer metadata

Skill Integrity Verification (Doctor)

doctor integrity check

skillshare doctor now verifies that tracked skills haven't been tampered with since installation. For skills with .skillshare-meta.json containing file_hashes, doctor computes current SHA-256 hashes and compares:

✓ Skill integrity: 5/6 verified
⚠ _team-repo__api-helper: 1 modified, 1 missing
⚠ Skill integrity: 2 skill(s) unverifiable (no metadata)

Two-phase approach for performance:

1. Phase 1 (cheap): filter to skills that have metadata with file hashes
2. Phase 2 (expensive): compute and compare hashes with spinner

Skills without metadata are reported as "unverifiable" — no false positives.

Web UI SSE Streaming

All operations now stream in real-time

All long-running web dashboard operations use Server-Sent Events (SSE) instead of batch HTTP requests:

Each page shows elapsed time, a progress bar, and results appear as they complete — no more staring at a spinner for 10+ repos.

New SSE endpoints:

• GET /api/audit/stream — streaming audit results
• GET /api/update/stream — streaming skill updates
• GET /api/check/stream — streaming repo checks
• GET /api/diff/stream — streaming target diffs

Virtualized scrolling

Audit results and diff item lists now use react-virtuoso virtual scrolling:

• Audit page: skill cards render on-demand as you scroll (window-level virtualization)
• Sync page diff: targets with 100+ items use a fixed-height virtualized container; smaller lists render directly

Replaces the previous "Show more" pagination buttons for a smoother UX.

SSL Error Guidance

When skillshare install encounters an SSL certificate error (self-signed cert, internal CA), the error message now shows three actionable options:

SSL certificate verification failed — options:
       1. Custom CA bundle: GIT_SSL_CAINFO=/path/to/ca-bundle.crt skillshare install <url>
       2. Skip verification: GIT_SSL_NO_VERIFY=true skillshare install <url>
       3. Use SSH instead: git@<host>:<owner>/<repo>.git

Detection covers: ssl certificate problem, unable to get local issuer certificate, self signed certificate, certificate verify failed, certificate verification failed.

Hardcoded Secret Detection

The problem

GitHub Secret Scanning detected a Google API Key (AIza...) in a skill file, but skillshare's audit engine missed it. The engine detects credential file access (cat ~/.ssh/id_rsa) and env var references (curl $TOKEN), but had zero detection for inline hardcoded secrets — API keys, tokens, and passwords embedded directly in text.

10 new hardcoded-secret rules (HIGH)

All rules are HIGH severity — they block installation at default threshold. Category: credential (same as credential-access family).

skillshare audit                                       # secrets detected automatically
skillshare audit rules --pattern hardcoded-secret      # list all secret rules
skillshare audit rules disable hardcoded-secret-9      # disable generic pattern if noisy

For educational/reference skills that intentionally contain example secrets, downgrade the entire group:

# audit-rules.yaml
rules:
  - pattern: hardcoded-secret
    severity: MEDIUM

Other Improvements

• Cleaner TUI layout — removed detail panel box borders in list/log views for less visual clutter

Upgrade

# Homebrew
brew upgrade skillshare

# Go install
go install github.com/runkids/skillshare/cmd/skillshare@v0.16.11

# Or download from GitHub Releases

Changelog

• 2af44f1 chore(skills): strengthen built-in skill descriptions and content
• 1aa8b56 chore: update readme
• 6730760 feat(audit): add hardcoded secret detection (10 rules)
• ebf2aaf feat(audit): add metadata analyzer for supply-chain trust verification
• ae5708e feat(doctor): add skill integrity verification via file hash comparison
• 272735c feat(install): detect SSL certificate errors and show actionable guidance
• 344b067 feat(ui): add SSE streaming for update, check, and diff pages
• 76c1904 feat(ui): add SSE-based audit streaming and real-time progress
• 7e072c3 feat(ui): replace "Show more" pagination with virtualized scrolling
• 0daafd2 style(tui): remove detail panel box borders for cleaner layout