repository·main·Indexed 25 days ago
https://github.com/runkids/skillshareA single source of truth for managing AI CLI skills, agents, rules, and commands. skillshare allows developers to maintain a central repository of AI instructions and sync them across multiple tools like Claude, Cursor, and Codex using symlinks, junctions, or copy mode. It includes a mapping API for custom extensions to transform Markdown into tool-specific formats, a TUI for context and token analysis via the `analyze` command, and security auditing capabilities to scan for prompt injection or data exfiltration.
skillshare init, the system automatically scans your environment to detect and configure any of these installed tools.The skillshare CLI is organized into several functional categories to manage skills, targets, and synchronization.
Used for basic lifecycle management: init (setup), install (add skills), uninstall (remove skills), list (view skills), search (find skills), sync (push to targets), and status (check sync state).
Used to manipulate individual skills: new (create), check (look for updates), update (apply updates), upgrade (upgrade CLI/built-ins), and enable/disable (toggle skill availability).
Used to manage where skills are deployed: target (manage targets) and diff (compare source and targets).
Used for non-skill resources like rules, commands, and prompts: extras (subcommands: init, list, remove, collect).
Used for data movement and version control: collect (pull from targets), backup/restore (manage backups), trash (manage uninstalled skills), and git-like operations: commit, push, and pull.
Used for maintenance and inspection: analyze (context usage), audit (security scan), log (audit logs), doctor (diagnostics), tui (interactive mode), ui (web dashboard), hub (manage hub sources), completion (shell completion), and version (CLI version).
The skillshare technical reference is organized into three main sections to help you master the CLI, configure AI targets, and understand the system environment:
The Skillshare documentation provides practical guides categorized by user intent and technical complexity. You can find guidance for:
The upgrade command manages three distinct components:
skillshare executable. It is downloaded from GitHub releases. If the binary resides in a protected directory (like /usr/local/bin), the command will automatically re-run with sudo if necessary.skillshare pre-downloads frontend assets for the new version. These are cached at ~/.cache/skillshare/ui/<version>/ and are used when running skillshare ui. If the pre-download fails, assets are downloaded during the next skillshare ui launch./skillshare command to AI CLIs. It is located at ~/.config/skillshare/skills/skillshare/SKILL.md.A Hub is a static JSON file named skillshare-hub.json that acts as a searchable index for skills. Each entry in the hub includes the skill's name, description, source, and tags.
Hubs are independent and highly portable. They can be hosted in several ways:
Because hubs are independent, users can connect to multiple hubs simultaneously, allowing for the coexistence of private organizational catalogs and public community catalogs.
Skillshare uses five structural templates (patterns) to define how an agent interacts with a task. Pick a pattern based on the primary goal of your skill:
| Pattern | What It Does | Use When |
|---|---|---|
tool-wrapper | Teaches agent how to use a library/API | Agent needs domain-specific conventions |
generator | Produces structured output from a template | You need consistent document/code formats |
reviewer | Scores/audits against a checklist | Code review, security audit, quality checks |
inversion | Agent interviews user before acting | Requirements gathering, project planning |
pipeline | Multi-step workflow with checkpoints | Complex tasks needing validation gates |
A skill manifest is a portable declaration of your skill collection. Instead of installing skills manually, you list them in a manifest file and use skillshare install to automate the setup. This allows for reproducible environments across different machines or for team onboarding.
There are two modes of operation:
.skillshare/config.yaml file located within your project directory. This file is intended to be committed to version control (e.g., Git) to share skill requirements with teammates.~/.config/skillshare/skills/.metadata.json. This represents your personal machine state and is typically not committed to version control.The audit engine classifies shell commands in skill files into behavioral safety tiers (T0–T6). This classification describes the kind of actions a skill performs, complementing pattern-based severity.
For .md files, only commands within fenced code blocks are analyzed.
| Tier | Label | Example Commands | Risk Level |
|---|---|---|---|
| T0 | read-only | cat, ls, grep, echo | INFO |
| T1 | mutating | mkdir, cp, mv, sed | LOW |
| T2 | destructive | rm, dd, kill, truncate | HIGH |
| T3 | network | curl, wget, ssh, nc | MEDIUM |
| T4 | privilege | sudo, su, chown, systemctl | HIGH |
| T5 | stealth | history -c, unset HISTFILE, shred | CRITICAL |
| T6 | interpreter | python, node, ruby, bun, deno, npx, pwsh, powershell | INFO |
The audit command acts as a gatekeeper. It scans skill content for known threat patterns before instructions reach your AI assistant.
Workflow Lifecycle:
skillshare install, an audit scan is triggered automatically.--force flag to bypass the block and install the skill.flowchart TD
A["Untrusted Skill<br/>(GitHub, shared repo)"] --> B["skillshare install"]
B --> C{"audit scan"}
C -- "Clean" --> D["Installed ✓"]
C -- "Threats found" --> E["Blocked ✗"]
D --> F["AI CLI executes<br/>skill instructions"]
E --> G["Review & decide"]
G -- "--force" --> D
G -- "Reject" --> H["Not installed"]
style C fill:#f59e0b,color:#000
style E fill:#ef4444,color:#fff
style D fill:#22c55e,color:#fffSkill patterns are building blocks that can be layered to match complex real-world needs. Instead of using a single rigid mold, you can combine them:
Skillshare distinguishes between regular skills (copied files) and tracked repositories (git clones).
| Aspect | Regular Skill | Tracked Repo |
|---|---|---|
| Source | Copied to source | Cloned with .git |
| Update | install --update | update <name> (git pull) |
| Prefix | None | _ prefix |
| Nested skills | Flattened | Flattened with __ |
The _ prefix is used to identify tracked repositories, helping prevent name collisions and making them easily identifiable in listings.