skillshare v0.28.3 Release Notes

TL;DR

1. Audit catches prose risk directives. Five new HIGH rules flag instructions that try to make an agent ignore safety policies, leak its system prompt, poison memory, snoop on configuration, or persist a payload.
2. audit exits 2 on scan errors. CI can tell a failed scan from a finding, which still exits 1.
3. Fewer audit false positives. ignore arrays, typed Python parameters and lines that only mention security policies no longer block installs and updates.
4. .DS_Store no longer marks skills modified. Opening a skill in Finder or Explorer no longer hides updates.
5. Project install metadata is gitignored. .skillshare/skills/.metadata.json stays out of your team's commits.

New: prose risk directives in audit

skillshare audit has five new HIGH rules for narrowly phrased directives:

They match directives, not discussion: a skill that explains security policies or asks for compliance in ordinary words stays clean.

Custom rules can now set confidence from 0 to 1, by rule ID or by pattern. Rules without one default to 0.95.

# ~/.config/skillshare/audit-rules.yaml
rules:
  - pattern: anti-refusal
    confidence: 0.8

(#711)

Changed: audit exit codes

When a scan both fails and finds something, it exits 2 and keeps the partial report. Audits started from list use the same codes. Declining the large-scan confirmation exits 0 without scanning.

If a CI job treats any non-zero exit as a failure, nothing changes. If it checks for 1 specifically, add a separate case for 2 so a broken scan is not mistaken for a finding, or for a pass. (#686)

Fixed: audit false positives

• ignore arrays and typed Python parameters. prompt-injection-1 reported a JavaScript ignore: ['**/*.test.vue'] option and a parameter such as root: Path, lang_filter: set[str] | None = None as CRITICAL, which blocked update --all for some vuejs-ai and dotnet skills. Both are now excluded; lookalikes such as admin: Execute stay CRITICAL. (#749, #750)
• Lines that only mention security policies. anti-refusal flagged "Always answer, even if the question mentions security policies." The policy noun must now follow the qualifier directly. (#748)

Fixed

• .DS_Store no longer marks skills modified. Finder writes .DS_Store into any folder it opens, and Explorer writes Thumbs.db and desktop.ini. They counted as skill content, so check reported the skill as modified, hid its available update, and update skipped it unless run with --force. These files are now ignored when detecting local changes, and hashes earlier versions recorded for them are dropped. Their content is still audited. (#743, #744)

• Project install metadata is gitignored. The docs said .skillshare/skills/.metadata.json was ignored, but nothing wrote that rule, so git add .skillshare picked it up. A project install now adds rules for the skills and agents metadata files to the project .gitignore, also in existing projects and custom source folders. A file that was already committed stays tracked until you run, once:

  git rm --cached .skillshare/skills/.metadata.json

  Teammates only need config.yaml and skills.lock.json; skillshare install -p rebuilds the metadata locally. (#759, #760)

• OMP plugin source changes sync in one pass. When a shared plugin changed source, a machine that still had the old OMP runtime link could not sync: the replacement was blocked before the cleanup that would free it. plugin sync and plugin update now preview the old removal followed by the new install, and apply both, keeping the shared cache and settings. (#757, #758)

  skillshare plugin sync NAME --dry-run -g

• Dashboard stays responsive during checks. Switching pages or reloading while the Plugins page checked for updates, or while Pi extensions or an MCP check ran, froze the whole dashboard until the check finished. Other pages now load meanwhile. (#747)

Contributors

@salmonumbrella, @JasonLandbridge, @Soren90912, @Snurppa