setup-skillshare

GitHub Action to install and initialize skillshare CLI — the universal skill manager for AI coding agents.

Skillshare syncs your AI coding skills (Claude, Cursor, Codex, Gemini, and 50+ more) from a single source of truth. This action sets up skillshare in CI so you can automate skill syncing, installation, and security auditing.

Quick Start

name: Sync Skillson: pushjobs:
sync:
runs-on: ubuntu-lateststeps:
- uses: actions/checkout@v4
- uses: runkids/setup-skillshare@v1with:
source: ./skills
- run: skillshare sync

Usage Examples

Sync team skills from your repo

Your team maintains a skills repo. CI checks it out and syncs to all AI CLI targets.

jobs:
sync-skills:
runs-on: ubuntu-lateststeps:
- uses: actions/checkout@v4
- uses: runkids/setup-skillshare@v1with:
source: ./skills
- run: skillshare sync

Sync to specific targets with copy mode

Only sync to Claude and Cursor, using copy mode (real files instead of symlinks).

- uses: runkids/setup-skillshare@v1with:
source: ./skillstargets: claude,cursormode: copy
- run: skillshare sync

Install a tracked repo from GitHub

Install an organization's shared skills repo with --track for future updates.

- uses: runkids/setup-skillshare@v1
- run: skillshare install your-org/skills --track
- run: skillshare sync

Install specific skills from a repo

Cherry-pick individual skills by name.

- uses: runkids/setup-skillshare@v1
- run: skillshare install your-org/skills --skill pdf,commit
- run: skillshare sync

Cross-machine sync with git remote

Set up a git remote so skills can be pushed/pulled across machines.

- uses: runkids/setup-skillshare@v1with:
remote: git@github.com:your-org/skills.git
- run: skillshare sync

Initialize with git

Create a fresh source directory with git initialized (useful for new setups).

- uses: runkids/setup-skillshare@v1with:
git: true

Project-level skills

Use project-level skills from .skillshare/ in the current directory.

- uses: actions/checkout@v4
- uses: runkids/setup-skillshare@v1with:
project: truetargets: claude,cursor
- run: skillshare sync -p

Pin a specific skillshare version

- uses: runkids/setup-skillshare@v1with:
version: "0.18.3"source: ./skills

Multi-platform matrix

jobs:
test:
runs-on: ${{ matrix.os }}strategy:
matrix:
os: [ubuntu-latest, macos-latest]steps:
- uses: actions/checkout@v4
- uses: runkids/setup-skillshare@v1with:
source: ./skills
- run: skillshare sync

Private repos with SSH

- uses: runkids/setup-skillshare@v1
- run: skillshare install git@github.com:your-org/private-skills.git --track
- run: skillshare sync

Private repos with HTTPS token

- uses: runkids/setup-skillshare@v1
- run: skillshare install https://github.com/your-org/private-skills.git --trackenv:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- run: skillshare sync

Security Audit

Skillshare has a built-in security scanner that detects prompt injection, credential theft, obfuscation, and 100+ threat patterns in AI skills.

Basic audit — fail CI on high severity

- uses: runkids/setup-skillshare@v1with:
source: ./skillsaudit: trueaudit-threshold: high

SARIF output for GitHub Code Scanning

- uses: runkids/setup-skillshare@v1with:
source: ./skillsaudit: trueaudit-format: sarifaudit-output: skillshare-audit.sarif
- uses: github/codeql-action/upload-sarif@v3if: always()with:
sarif_file: skillshare-audit.sarifcategory: skillshare-audit

Strict audit with JSON report

- uses: runkids/setup-skillshare@v1with:
source: ./skillsaudit: trueaudit-threshold: mediumaudit-profile: strictaudit-format: jsonaudit-output: audit-results.json

Audit on pull requests that modify skills

name: Skill Validationon:
pull_request:
paths: ['skills/**']jobs:
validate:
runs-on: ubuntu-lateststeps:
- uses: actions/checkout@v4
- uses: runkids/setup-skillshare@v1with:
source: ./skillsaudit: trueaudit-threshold: highaudit-format: sarifaudit-output: skillshare-audit.sarif
- uses: github/codeql-action/upload-sarif@v3if: always()with:
sarif_file: skillshare-audit.sarifcategory: skillshare-audit
- run: skillshare sync --dry-run

Inputs

Setup

Input	Description	Default
version	Skillshare version to install (without v prefix)	latest
source	Path to skills source directory	—
targets	Comma-separated target names (e.g. claude,cursor)	all detected
mode	Sync mode: merge, copy, or symlink	merge
git	Initialize git in source directory	false
remote	Git remote URL for cross-machine sync (implies git: true)	—
project	Use project-level skills (.skillshare/)	false
github-token	GitHub token for API requests to avoid rate limits	${{ github.token }}

Audit

Input	Description	Default
audit	Run security audit after setup	false
audit-threshold	Severity threshold: critical, high, medium, low, info	high
audit-format	Output format: text, json, sarif, markdown	text
audit-profile	Audit profile: default, strict, permissive	—
audit-output	File path to save audit results	—

Outputs

Output	Description
version	The installed skillshare version
audit-exit-code	Audit exit code: 0 = clean, 1 = findings

Using outputs

- uses: runkids/setup-skillshare@v1id: skillsharewith:
source: ./skillsaudit: trueaudit-output: audit.sarif
- run: echo "Installed ${{ steps.skillshare.outputs.version }}"
- run: echo "Audit result: ${{ steps.skillshare.outputs.audit-exit-code }}"

How it works

1. Download skillshare binary (with retry, cached in $RUNNER_TOOL_CACHE)
2. Initialize via skillshare init with CI-friendly defaults
3. Audit (optional) with configurable threshold and output format

The action always runs skillshare init to create config.yaml — this is required before any skillshare operation. After setup, run skillshare sync, skillshare install, or any other command in subsequent steps.

Global mode (default)

skillshare init --no-copy --no-skill --all-targets --no-git [--source] [--targets] [--mode] [--git] [--remote]

• --no-copy — skip interactive copy-from prompt
• --no-skill — skip built-in skill installation
• --no-git — by default (override with git: true or remote)
• --all-targets — by default (override with targets)

Project mode (project: true)

skillshare init -p [--targets] [--mode]

Project mode only accepts --targets and --mode. Flags like --source, --git, --remote are not applicable — project skills live in .skillshare/ of the current directory.

Reliability

• No gh CLI dependency — version resolution uses HTTP redirect, falls back to gh api if available. Works on self-hosted runners.
• Download retry — curl --retry 3 for transient network failures
• Same-run cache — binary cached in $RUNNER_TOOL_CACHE, skipped if already downloaded
• Shell safety — all inputs passed through env: vars, never expanded directly in shell

Supported platforms

• ubuntu-latest (linux/amd64)
• macos-latest (darwin/arm64)
• macos-13 (darwin/amd64)

Alternative

You can also install skillshare without this action:

- run: curl -fsSL https://raw.githubusercontent.com/runkids/skillshare/main/install.sh | bash
- run: skillshare init --no-copy --all-targets --no-git --no-skill

License

MIT