skillshare v0.20.18 Release Notes

TL;DR

1. Dashboard project-root installs are blocked — project-mode installs from the web dashboard now reject the project root before it can copy into .skillshare/skills.
2. Trash operations enforce safer path boundaries — trash, restore, and cleanup flows now reject traversal-style names while keeping safe nested skills and agents working.

Bug fix: dashboard project-root installs are rejected before copying into themselves

The web dashboard now matches the CLI behavior for project-mode local installs. If a local source resolves to the project root, Skillshare rejects it and tells users to install a specific skill subdirectory instead:

skillshare install ./ -p
# rejected: cannot install the project root into itself

skillshare install ./my-skill -p
# still accepted

This prevents recursive copies under .skillshare/skills when installing from the dashboard.

Bug fix: trash operations reject traversal-style names

Trash operations now validate names and destination paths before moving, restoring, or cleaning up files. Inputs with traversal segments, absolute paths, backslashes, NUL characters, or empty names are rejected before filesystem writes or removals happen.

Safe nested names continue to work:

org/team-skill
demo/my-agent

This hardens trash recovery and cleanup without changing normal skill or agent trash workflows.

Changelog

• c09968d chore: release v0.20.18
• 54ae7b0 fix(install): reject project-root self-install via web UI
• 1ad1358 harden trash path boundary checks