Install
$ agentstack add skill-runkids-skillshare-skillshare-cli-e2e-test Open-source listing, not yet scanned by AgentStack. Follow the source repository for install instructions.
Security review
⚠ Flagged1 finding(s); flagged for manual review. · v0.1.0 How review works →
- • Prompt-injection patterns
- • Secret / credential exfiltration
- • Dangerous shell & filesystem operations
- • Untrusted network calls
- • Known-malicious package signatures
- high Destructive filesystem operation.
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Run isolated E2E tests in devcontainer. $ARGUMENTS specifies runbook name or "new".
Flow
Phase 0: Environment Check
- Confirm devcontainer is running and get container ID:
``bash CONTAINER=$(docker compose -f .devcontainer/docker-compose.yml ps -q skillshare-devcontainer) ``
- If empty → prompt user:
docker compose -f .devcontainer/docker-compose.yml up -d - Ensure
CONTAINERis set for all subsequentdocker execcalls.
- Confirm Linux binary is available:
``bash docker exec $CONTAINER bash -c \ '/workspace/.devcontainer/ensure-skillshare-linux-binary.sh && ss version' ``
- Confirm mdproof is installed:
``bash docker exec $CONTAINER /workspace/.devcontainer/ensure-mdproof.sh ` This auto-installs from GitHub release, or falls back to /workspace/bin/mdproof` (local dev binary).
- Check for lessons learned from previous runs:
``bash test -f /workspace/.mdproof/lessons-learned.md && cat /workspace/.mdproof/lessons-learned.md `` If the file exists, read it before writing or debugging runbooks — it contains known gotchas and assertion patterns.
Phase 1: Detect Scope
- Preview all available runbooks via the container:
``bash docker exec $CONTAINER mdproof --dry-run --report json /workspace/ai_docs/tests/ `` This returns JSON with every runbook's steps, commands, and expected assertions — no manual markdown parsing needed. Use this to understand what each runbook covers.
- Identify recent changes (unstaged + recent commits):
``bash git diff --name-only HEAD~3 ``
- Match changes to relevant runbooks (compare changed file paths against step commands in the JSON output).
Phase 2: Select Tests
Prompt user (via AskUserQuestion):
- Option A: Run existing runbook (list all available + mark those related to recent changes)
- Option B: Auto-generate new test script based on recent changes
- Option C: If $ARGUMENTS specifies a runbook, skip to Phase 3
Phase 3: Prepare & Execute
Running existing runbook:
- Create isolated environment with auto-initialization:
```bash ENV_NAME="e2e-$(date +%Y%m%d-%H%M%S)"
# Use --init to automatically run 'ss init -g' with all targets docker exec $CONTAINER ssenv create "$ENV_NAME" --init ```
- Execute the entire runbook via mdproof inside the container:
``bash docker exec $CONTAINER env SKILLSHARE_DEV_ALLOW_WORKSPACE_PROJECT=1 \ ssenv enter "$ENV_NAME" -- \ mdproof --report json \ /workspace/ai_docs/tests/.md ` mdproof executes each step (bash -c ) in the ssenv-isolated HOME, then returns structured JSON: `json { "version": "1", "runbook": ".md", "duration_ms": 12345, "summary": { "total": 7, "passed": 5, "failed": 1, "skipped": 1 }, "steps": [ { "step": { "number": 1, "title": "...", "command": "...", "expected": ["..."] }, "status": "passed", // "passed" | "failed" | "skipped" "exit_code": 0, "stdout": "...", "stderr": "..." } ] } ``
- Analyze the JSON output:
- All passed → proceed to Phase 4
- Any failed → filter for failures only (full JSON can be too large for terminal output):
``bash mdproof --report json runbook.md 2>&1 | jq '{ summary: .summary, failed: [.steps[] | select(.status == "failed") | { step: .step.number, title: .step.title, exit_code: .exit_code, failed_assertions: [.assertions[]? | select(.matched == false) | .pattern], stderr: (.stderr // "" | .[0:200]) }] }' ``
- Skipped steps (executor=
manual) → these need manual verification, run them individually:
``bash docker exec $CONTAINER env SKILLSHARE_DEV_ALLOW_WORKSPACE_PROJECT=1 \ ssenv enter "$ENV_NAME" -- ``
- For failed steps, debug individually using manual docker exec (same as before):
``bash docker exec $CONTAINER env SKILLSHARE_DEV_ALLOW_WORKSPACE_PROJECT=1 \ ssenv enter "$ENV_NAME" -- bash -c '' ``
- Prefer
--json+jqfor assertions — see the JSON Reference below
Generating new runbook:
- Read
git diff HEAD~3to find changed files incmd/skillshare/orinternal/ - Read changed files to understand new/modified functionality
- Validate all CLI flags before writing — for every
ssin the runbook:
- Grep
cmd/skillshare/.gofor the exact flag string (e.g."--force") - Run
ss --helpinside container if needed - Common mistakes to avoid:
uninstall --yes→ wrong, use--force/-finit --target→ wrong,inithas no--targetflaginit -phas a completely separate flag set from globalinit— only supports--targets,--discover,--select,--mode,--dry-run. Global-only flags like--no-copy,--no-skill,--no-git,--all-targets,--forcedo NOT exist in project mode- Audit custom rules: disable by rule ID (e.g.
prompt-injection-0,prompt-injection-1), NOT pattern name (e.g.prompt-injection). Rule IDs are ininternal/audit/rules.yaml
- Generate new runbook to
ai_docs/tests/_runbook.md, following existing conventions:
- YAML-free, pure Markdown
- Has Scope, Environment, Steps (each with bash + Expected), Pass Criteria
- Use
jq:assertions in Expected blocks for JSON commands — e.g.- jq: .extras | length == 1. This is a native mdproof assertion type, NOT a bashjqpipe - Use
--json+jq -ein bash for inline verification within multi-command steps - Config idempotency — never bare
cat >> config.yaml; always prependsed -i '/^section:/,$d'to remove existing section first, or use CLI commands (ss extras init,ss extras remove --force) that handle duplicates - Check
ai_docs/tests/runbook.jsonfor project-level config (build, setup, teardown, step_setup, timeout) that affects all runbooks - Check
.mdproof/lessons-learned.mdfor known assertion patterns and gotchas
- Run the runbook quality checklist (see below) before executing
- Then execute the new runbook (same flow as above)
Phase 4: Cleanup & Report
- Ask user before cleanup (via AskUserQuestion):
- Option A: Delete ssenv environment now
- Option B: Keep for manual debugging (print env name for later
ssenv delete)
- If user chose Option A:
``bash docker exec $CONTAINER ssenv delete "$ENV_NAME" --force ``
- Output summary (derived from the runbook JSON output):
``` ── E2E Test Report ──
Runbook: {runbook name} Env: {ENVNAME} Duration: {durationms}ms
Step 1: {title} PASS Step 2: {title} PASS Step 3: {title} FAIL ← exit_code={N}, stderr: {error detail} ...
Result: {passed}/{total} passed ({skipped} skipped) `` All values come directly from mdproof's JSON output — summary.passed, summary.total, steps[].step.title, steps[].status`.
- If any FAIL → distinguish between runbook bug vs real bug:
- Runbook bug: wrong flag, wrong file path, stale assertion → fix runbook, re-run step
- Real bug: CLI misbehavior → analyze cause, provide fix suggestions
- Retrospective — ask user (via AskUserQuestion):
> Did you encounter any friction during this test run that the skill or runbook could handle better?
- Option A: Yes, improve e2e skill — review test friction (wrong flags, stale assertions, missing checklist items, unclear instructions), then update SKILL.md and/or runbooks
- Option B: Yes, but only fix the runbook — fix the specific runbook without changing the skill itself
- Option C: No, skip
Improvement targets:
- SKILL.md: add new checklist items, common-mistake examples, or rule clarifications learned from this run
- Runbooks: fix stale assertions (e.g. config.yaml → registry.yaml), wrong flags, outdated paths
- Both: when a systemic issue (e.g. a refactor changed file locations) affects both the skill's guidance and existing runbooks
Runbook Quality Checklist
Before executing a newly generated runbook, verify:
- [ ] All CLI flags exist — every
ss --flagwas grep-verified against source - [ ]
--initinteraction — if runbook hasss init, account forssenv create --initalready initializing (add--forceto re-init, or skip init step) - [ ]
--initcreates default extras —ssenv create --initcreates arulesextra by default. Runbooks that assume an empty extras list must add cleanup first:ss extras remove rules --force -g 2>/dev/null || true+rm -rf ~/.claude/rules - [ ] Correct confirmation flags —
uninstalluses--force(not--yes);initre-run needs no flag (just fails gracefully) - [ ] Skill data in registry.yaml — assertions about installed skills check
registry.yaml, NOTconfig.yaml; config.yaml should never containskills: - [ ] File existence timing —
registry.yamlis only created after first install/reconcile, not onss init - [ ] Project mode paths — project commands use
.skillshare/not~/.config/skillshare/ - [ ] Project init flags —
init -ponly supports--targets,--discover,--select,--mode,--dry-run; global-only flags (--no-copy,--no-skill,--no-git,--all-targets,--force) are not available - [ ] Audit rule IDs — custom rules in
audit-rules.yamluse rule IDs (e.g.prompt-injection-0), not pattern names (e.g.prompt-injection). Verify IDs againstinternal/audit/rules.yaml - [ ] Use
--jsonfor assertions — if the command supports--json, use it withjqinstead of grepping human-readable output. Text output changes between versions; JSON structure is stable - [ ] Expected = actual substrings, NOT descriptions — the runbook assertion engine does case-insensitive substring matching. Write
- Installedor- cangjie-docs-navigator, NOT- Install completes without erroror- Output contains at least one skill. Negation: useNotprefix (e.g.- Not cangjie-docs-navigator) - [ ] Skill name ≠ repo name — after
ss install, the actual skill name may differ from the repo name (e.g. repocangjie-docs-mcp→ skillcangjie-docs-navigator). Always verify the installed skill name viass listbefore writing uninstall/check steps - [ ]
/tmp/cleanup — ssenv only isolates$HOME;/tmp/is shared across runs. Any step using/tmp/must start withrm -rf /tmp/to avoid stale state from previous runs - [ ]
echo > symlinkwrites through —echo "content" > pathwherepathis a symlink writes to the symlink's target, it does NOT replace the symlink with a real file. To create a local (non-managed) file at a symlinked path: either use a different filename, orrmthe symlink first thenecho - [ ]
cat >>is not idempotent — appending to config files (cat >> config.yaml) will duplicate sections on re-run. Preferss extras init(which validates duplicates) or full file replacement overcat >>when possible - [ ] Extras source path layout — extras use
~/.config/skillshare/extras//(not the legacy flat path~/.config/skillshare//). Symlink assertions must includeextras/in the path regex (e.g.regex: skillshare/extras/rules/tdd\.md) - [ ] Prefer
jq:overpython3 -c— for JSON output validation, use mdproof's nativejq:assertion type (e.g.- jq: .extras | length == 1) instead of piping topython3 -c. It's one line vs 10, and mdproof handles failure reporting automatically - [ ] Config append idempotency — when appending YAML sections with
cat >>, always prependsed -i '/^section_key:/,$d'to remove existing section. Or prefer CLI commands (ss extras init,ss extras remove --force) over manual config editing - [ ] Check lessons-learned — read
.mdproof/lessons-learned.mdbefore writing new runbooks for known gotchas and proven assertion patterns
Runbook Assertion Types
mdproof supports 6 assertion types under Expected: blocks. Use the most specific type for each check:
| Type | Syntax | When to use | Example | |------|--------|-------------|---------| | Substring | plain text | Simple output check | - hello world | | Negated | Not/Should NOT prefix | Verify absence | - Not FAIL | | Exit code | exit_code: N | Every step should have this | - exit_code: 0 | | Regex | regex: prefix | Pattern matching | - regex: v\d+\.\d+ | | jq | jq: prefix | JSON output (preferred) | - jq: .extras \| length == 1 | | Snapshot | snapshot: prefix | Stable output comparison | - snapshot: api-response |
jq: best practices:
# Simple field check
- jq: .name == "rules"
# Array length
- jq: .extras | length == 3
# Sorted array comparison
- jq: [.extras[].name] | sort | . == ["a","b","c"]
# Null/missing field (omitempty)
- jq: .extras == null
# Nested access
- jq: .[0].targets[0].status == "synced"
# Boolean
- jq: .source_exists == true
Rules
- Always execute inside devcontainer — use
docker exec, never run CLI on host - Always use
ssenvfor HOME isolation — don't pollute container default HOME - Always create fresh ssenv environments — never reuse an environment from a previous run; stale config/state causes confusing cascade failures (e.g. duplicate YAML keys, "already exists" errors)
- ssenv only isolates
$HOME—/tmp/,/var/, and other system paths are shared across all environments. Runbook steps using/tmp/must includerm -rfcleanup at the start - Verify every step — never skip Expected checks
- Don't abort on failure — record FAIL, continue to next step, summarize at end
- Ask before cleanup — Phase 4 must prompt user before deleting ssenv environment
ss=skillshare— same binary in runbooks~= ssenv-isolated HOME —ssenv enterauto-setsHOME- Use
--init— simplify setup by usingssenv create --init --initalready runs init — the env is pre-initialized; runbook steps callingss initagain will fail unless the step explicitly resets state first
ssenv Quick Reference
| Command | Purpose | |---------|---------| | sshelp | Show shortcuts and usage | | ssls | List isolated environments | | ssnew | Create + enter isolated shell (interactive) | | ssuse | Enter existing isolated shell (interactive) | | ssback | Leave isolated context | | ssenv enter -- | Run single command in isolation (automation) |
- For interactive debugging:
ssnewthenexitwhen done - For deterministic automation: prefer
ssenv enter --one-liners
Test Command Policy
When running Go tests inside devcontainer (not via runbook):
# ssenv changes HOME, so always cd to /workspace first for Go test commands
cd /workspace
go build -o bin/skillshare ./cmd/skillshare
SKILLSHARE_TEST_BINARY="$PWD/bin/skillshare" go test ./tests/integration -count=1
go test ./...
Always run in devcontainer unless there is a documented exception. Note: ssenv enter changes HOME, which may affect Go module resolution — always cd /workspace before running go test or go build.
--json Quick Reference
Most commands support --json for structured output, making assertions more reliable than text matching.
| Command | --json | Notes | |---------|----------|-------| | ss status | --json | Skills, targets, sync status | | ss list | --json / -j | All skills with metadata | | ss target list | --json | Configured targets | | ss install | --json | Implies --force --all (skip prompts) | | ss uninstall | --json | Implies --force (skip prompts) | | ss collect | --json | Implies --force (skip prompts) | | ss check | --json | Update availability per repo | | ss update | --json | Update results per skill | | ss diff | --json | Per-file diff details | | ss sync | --json | Syn
…
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: runkids
- Source: runkids/skillshare
- License: MIT
- Homepage: https://skillshare.runkids.cc
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.