skillshare v0.30.7 Release Notes

TL;DR

1. audit --respect-accepted stops failing on findings you accepted with --force. The dashboard now always honors those acceptances.
2. Source credentials no longer reach the operation log. A token in an install URL was written to operations.log.
3. A broken audit-rules.yaml no longer turns the audit off. Scans report the error, and an install whose audit cannot run is blocked.
4. install --json no longer overwrites without --force. Kept items are listed in a new skipped array.
5. Reinstalling a skill from the same repo is skipped, as documented, instead of failing with "already exists", and skillshare log now lists what an install skipped.
6. OMP plugins installed into an already-registered marketplace update again, and imported plugins that update natively are skipped instead of failing plugin update --all.
7. The dashboard Doctor page shows each health check as it finishes instead of waiting for the slowest one.

Audit: respect findings accepted with --force

install and update --force record the findings you accepted, but skillshare audit ignored that record, so a skill installed with --force kept failing a CI audit. Pass --respect-accepted to keep accepted findings in every report, marked as accepted, without failing the audit. Without the flag nothing changes, and a changed finding needs a new acceptance. It works in global and project mode and for audit agents, including skills inside tracked repositories, except bundled hook and settings findings. (#869, #872)

skillshare audit --respect-accepted
skillshare audit --respect-accepted --format sarif > audit.sarif

• JSON marks an accepted finding with acknowledged: true and counts it in summary.accepted instead of its severity.
• Text and the TUI add an "accepted earlier with --force" note; Markdown adds (accepted earlier) and an Accepted summary row; SARIF reports it as an external suppression.
• The risk score and label still include accepted findings: they describe the content, and acceptance only changes whether it blocks.

The dashboard always honors acceptances. The Audit page mutes accepted findings, sorts them last and adds an Accepted count and a Show accepted filter. A skill's Audit tab collapses them, and the Dashboard attention card no longer lists a skill whose only blocking findings were accepted.

Security: credentials and audit rules

install wrote the source to the operation log exactly as you typed it, so a URL such as https://user:token@host/repo.git left the token in operations.log. Sources are now logged without user info, query or fragment, including where a log message repeats them. (#878, #881)

When the global audit-rules.yaml did not parse or one of its patterns did not compile, global scans dropped the error and ran without any pattern rules, so audits reported fewer findings with no warning. Project mode already reported the error. (#879, #882)

• Every scan that uses the rules now reports a scan error that names the file.
• An install whose audit cannot run is blocked, and what it installed is removed, for skills, agents and tracked repositories. --force does not override this, because it accepts findings and a scan that did not run has none; --skip-audit still skips scanning.
• update and upgrade --skill keep the installed copy when the audit cannot run. update --all lists the item under "Blocked by security audit" and exits nonzero.

Install: JSON output, skips and the operation log

--json used to turn on --force, so a script that only wanted JSON output replaced locally edited skills and agents. JSON output now changes only the output: existing items are kept and listed in a new skipped array, and overwriting needs --force. install -p --json no longer follows a changed lock pin unless --force or --update is given. (#877, #884)

skillshare install owner/repo --json            # keeps existing items, lists them in "skipped"
skillshare install owner/repo --json --force    # overwrites them

The docs said a reinstall from the same repository is skipped with a warning, but the check read only a per-skill file that installs no longer write, so the reinstall failed with "already exists". It now reads .metadata.json. (#887)

• Reinstalling the same skill of a repo without --force exits 0 and lists it under skipped.
• Another skill of that repo that would take the same folder, for example through --name, is still a conflict.
• Reinstalling a single-skill repo with -s <skill> -a <agent> still installs the requested agent.
• In the dashboard, batch installs report kept skills and agents as skipped instead of installed, and the install dialog says they are already installed. A tracked reinstall of the same repo returns 409 and is logged as skipped. The Herdr panel reports skipped names the way it reports failed ones.

Install entries in the operation log now record skipped skills and agents, and skillshare log shows them as skipped=. This covers CLI installs, skillshare search installs and dashboard installs, including installs from config. (#886, #887)

Plugins: OMP updates and imported plugins

An OMP install into a marketplace that was already registered used OMP's cached catalog, so OMP recorded an older version than the reviewed source. The next update could not find the cache to remove, and plugin update --all skipped it while exiting 0. (#851, #853)

• Installing into an already-registered marketplace now refreshes its catalog first, as update already did.
• Removal follows OMP's own registry entry when it is present and verified, even if its version differs from the one skillshare recorded. Shared caches are kept as before, and an interrupted removal resumes with the version it started.
• When an OMP update is blocked, plugin update --all reports that target as failed with its reason and keeps updating the others. A dry run prints the whole plan and exits nonzero, and --json marks the failed change with failed: true. The CLI preview and the dashboard show it as failed.

Imported plugins that skillshare cannot update, because they have no reviewed source, are now always an intentional skip that points you to the native client. Before, skillshare first checked whether the native CLI supported the update command, and a failed check turned the skip into a failure. An imported Grok plugin always hit this, because Grok updates require native trust, so every plugin update --all exited nonzero. Changes that do run a native command are still checked. (#873)

Dashboard: Doctor

The Doctor page used to show a skeleton until every check had finished, which could take about 30 seconds when a native plugin CLI did not answer, and the request was sometimes cut off by the server's timeout. Checks now appear as they finish, and Run again keeps the previous result on screen until the new one is done. When an audit, diff or doctor stream fails, the page shows the server's reason instead of a generic connection message. The new GET /api/doctor/stream endpoint streams the checks; GET /api/doctor is unchanged. Doctor also skips its Git reads for hooks when no hooks are configured. (#870)

Contributors

@salmonumbrella @vieGPT