skillshare v0.26.0 Release Notes

TL;DR

1. Keep per-Agent MCP settings in one source, and edit them in the dashboard.
2. Serve skills to Executor from the same HTTP server as your MCP tools.
3. Store hook code and scripts in files next to the config instead of inside YAML.
4. OMP plugins install the OMP build, even when a repository also ships a Claude build with the same name.

Per-Agent MCP settings

A server's options map holds native fields that do not have a portable equivalent. Sync writes each block only to its Agent, including that Agent's account targets:

mcp:
  servers:
    docs:
      url: https://example.com/mcp
      targets: [codex, claude]
      options:
        codex:
          default_tools_approval_mode: approve
        claude:
          timeout: 600000

The dashboard's Other Agent settings editor accepts one JSON object per Agent. Pi keeps its existing piOptions block.

Fields already managed by portable settings are refused. Credentials must be whole-value environment references in syntax the receiving Agent supports; plaintext credentials are refused. Options for an Agent the server does not reach stay in the source without being written. Dropping an option removes the field on the next sync unless it has changed in the Agent's file, in which case sync reports a conflict.

Serve skills to Executor

mcp serve --http now publishes an Executor-compatible skill index at /.well-known/agent-skills/index.json and serves the files listed in it:

skillshare mcp serve --http 127.0.0.1:8765
skillshare mcp serve --check

Executor apps can load it with wellKnownSkills. File changes update the index versions, so Executor picks up edits on its next check without a commit or push. --check reports the skills, files and bytes served and explains why a skill was left out.

The index leaves out skills Executor cannot load, including binary files and files over 2 MB. The index uses the MCP server's bearer token when configured. That token also grants access to the MCP tools, including editing when enabled; use a separate mcp serve without mcp.serve.edit for a read-only connection.

Non-loopback serving requires a token and TLS. Executor refuses private and loopback addresses by default: Cloud needs a public address, and self-hosted operators must explicitly enable private fetches. The Executor host must be able to reach the server and trust its certificate; redirects are refused.

Hook code and scripts in files

Use codeFile instead of inline extension code, or {from: path} for a script in files:

hooks:
  entries:
    lint:
      bindings:
        pi:
          codeFile: hooks/lint.pi.ts
        cursor:
          events:
            afterFileEdit:
              - command: .cursor/hooks/skillshare/lint/lint.sh
          files:
            lint.sh: { from: hooks/lint.sh }

Paths resolve against the folder of the config that owns the entry: .skillshare/ in a project, or the global config's folder for hooks.projects. Even with hooks add|edit --file, they are relative to the selected config, not the entry file. Paths must stay inside that folder without passing through symlinks.

Edit the files and run hooks sync. A missing file stops config loading; a file changed after a preview makes the apply stale. Saving an entry preserves references; editing code or scripts in the dashboard stores the edit inline.

YAML entry files also keep the final newline of a trailing code: | block. Extensions written from those files no longer lose the newline expected by formatters; JSON entry files were unaffected.

OMP marketplace builds

When a repository ships same-named OMP and Claude plugins, adding the plugin to OMP now selects its .omp-plugin/marketplace.json build. This includes extension-only package.json manifests using omp.extensions or the compatible pi.extensions field.

Claude catalog fallback applies only when there is no OMP catalog. A broken catalog or missing native entry no longer silently installs the Claude build. An explicit catalog version reaches the native install, and discovery and dashboard previews show the selected build's path, version and components instead of combining unrelated metadata.

Thanks to @salmonumbrella for reporting the wrong-build installation (#587).

Dashboard shortcuts

• Keep all local and Keep all remote select a whole-file resolution for every pull conflict. You can still override files individually before Apply choices and pull. Selecting a side alone writes nothing.
• Update to latest on memory guidance opens the existing connection review with all outdated tools selected and their read/write modes preserved. You review and apply the changes; modified guidance blocks stay untouched.

skillshare v0.25.13 Release Notes

TL;DR

1. mcp serve can edit the skills you list. An Agent previews the full diff and audit result, then saves exactly that preview. Editing stays off until you list skills.
2. list_skills and read_skill are marked read-only, so clients that ask before tools that change data stop asking for them.

Edit skills over mcp serve

An Agent that reaches your skills only through mcp serve could read them but had to hand every change back to you. Skills you list in mcp.serve.edit.skills can now be changed one existing file at a time:

mcp:
  serve:
    edit:
      skills: [pdf, _team__*]   # flat names, matched like a target's include
      preview_ttl: 30m          # how long a preview can be applied; default 30m

The server then offers two more tools:

1. preview_skill_edit takes a file, the revision the Agent read, and the complete new content. It writes nothing and returns the full diff, the audit findings and a preview id.
2. apply_skill_edit takes only that preview id and saves exactly what was previewed, once. It is marked destructiveHint, so a client that asks before such tools asks you.

An edit is refused, and nothing is written, when:

• the skill is not listed, sits in a tracked repo, or was installed from upstream, since update would overwrite the change;
• the file changed after it was read or previewed;
• the skill would fail validation, or the file is not UTF-8 text;
• the audit finds something at or above audit.block_threshold. As with install, a finding you accepted with install --force does not block, and each finding is marked new or existing so you can see what the edit adds;
• the preview is older than preview_ttl, was already applied, or the server restarted.

An edit cannot create, delete or rename files. Each save goes to the operations log and each audit to skillshare log --audit. Targets get the change on the next sync. skillshare mcp serve --check reports how many served skills are editable.

Thanks to @salmonumbrella for proposing safe skill editing over MCP (#540).

Read-only skill tools

Clients and gateways that gate tools by annotation treat a tool without readOnlyHint as one that changes data, so every list_skills or read_skill call could stop for approval. Both tools are now marked read-only and are called without asking.

Contributors

@star-nebula

skillshare v0.25.12 Release Notes

TL;DR

1. Git tokens no longer show up in ps. A token from GITHUB_TOKEN or another token variable now reaches git through a credential helper, never through process arguments.
2. update --all leaves unchanged skills alone. Skills already at the upstream commit are counted as up to date instead of being reinstalled on every run.
3. update reports a repository it cannot fetch, and updates skills whose symlinked files changed upstream.
4. An open dashboard keeps working after upgrade.

Fixed: git tokens visible in ps

A token from GITHUB_TOKEN, GITLAB_TOKEN, BITBUCKET_TOKEN, AZURE_DEVOPS_TOKEN, GITEA_TOKEN, CNB_TOKEN or SKILLSHARE_GIT_TOKEN was written into the clone URL that git hands to its HTTPS helper. Any user on the machine could read it with ps while a clone or fetch ran.

• git now gets the token from a credential helper scoped to the host. The token stays in the git process's environment and never appears in an argument list.
• While a token applies to a host, git no longer asks your own credential helper or keychain for that host, and stores nothing there.

Thanks to @masonc15 for reporting it (#565).

Fixed: update --all reinstalls every skill

Grouped updates reinstalled every skill on every run and reported each one as updated. The up-to-date check read per-skill metadata files that the move to .metadata.json had removed, so it never matched.

skillshare update --all          # unchanged skills are counted as up to date
skillshare update --all --force  # reinstall every skill

• A skill already at the upstream commit, or whose folder did not change, is skipped and counted as up to date: in the summary, as up_to_date in --json, and in the operations log.
• This applies to --all, --group, and several skills named with -p. A single skill, and skills named in global mode, are still always reinstalled.
• --force reinstalls every skill anyway.

Thanks to @masonc15 for reporting and fixing it (#564, #569).

Fixed: a repository that cannot be fetched goes unreported

When update --all or --group could not clone a repository, its skills were counted as skipped with no explanation, which hid a repository that failed on every run. update now prints a warning that names the repository and the git error. Credentials in the URL, including query tokens, are removed from both. Thanks to @masonc15 (#570).

Fixed: skills with symlinks miss updates

A skill folder can hold a symlink to a file elsewhere in its repository. Install copies the target's content, but the folder's git tree hash ignores it, so after the target changed update skipped the skill and check reported it up to date.

A skill whose folder contains a symlink is now compared by commit: update reinstalls it whenever the upstream commit moves, and check reports an update (#572).

Fixed: the open dashboard breaks after upgrade

upgrade pre-downloads the new version's UI assets and removed every other cached version, including the one a running skillshare ui server still loads pages from, so navigating the open dashboard broke. The pre-upgrade version's assets are now kept as well. Restart the UI server between upgrades: a second upgrade without a restart can still remove the oldest server's assets.

Contributors

@masonc15

skillshare v0.25.11 Release Notes

TL;DR

1. Unpinned MCP servers are flagged. mcp check warns when a local server starts a package or image without an exact version, so a compromised release cannot reach your machine on the next Agent launch unnoticed.
2. Changed MCP tools are flagged. mcp check --live records each server's tool definitions and warns when a description or input schema changes, or a new tool appears, until you accept it.
3. Backup cleanup frees space an interrupted backup left behind.
4. skillshare list shows every Agent a skill or agent is synced to, in any sync mode or naming.

New: warn about unpinned MCP servers

A server launched with npx, uvx or pipx run downloads its code at every start. Without an exact version, every Agent launch can run a release you have never seen. mcp check now names these servers:

skillshare mcp check

• npx, uvx and pipx run warn when a package has no exact version: none, latest, a dist-tag such as next, a range such as ^1.2, or a ==1.* wildcard. Every npx --package and uvx --with package is checked.
• docker run and podman run warn on an image with no tag or latest. An image pinned by tag but not by @sha256: digest is a note, since a tag can move.
• It reads only command and args; nothing is downloaded or started.
• The warning also shows in doctor and on the dashboard's MCP page. It is a warning only: sync and the Agents keep working, and the exit code does not change. To clear it, write the exact version, such as @playwright/mcp@0.0.83.

New: detect MCP tool definitions that change

An Agent reads a tool's description as instructions, and a server can change it after you trusted it (a "rug pull"). mcp check --live now records a hash of each tool's name, description and input schema the first time a server answers, and compares every later probe with it:

skillshare mcp check --live                              # pins tools on the first run
skillshare mcp check docs --live --accept-tools -g       # accept docs' current tools

• A changed description or schema, or a new tool, is a warning that repeats until you run --accept-tools. A removed tool is a note.
• Only hashes are stored, in mcp/tool-pins.json of the state directory. A check without --live never reads or writes them.
• Each --accept-tools is written to the operations log (skillshare log) with the servers it accepted.
• It works for local and remote servers, so it also covers remote servers that have no version to pin.

Fixed: backup cleanup misses interrupted backups

A backup interrupted mid-copy left a hidden .snapshot-* directory that backup --cleanup never found, so it kept using disk space. Cleanup now removes these, even when there are no completed snapshots, and --cleanup --dry-run lists them. A backup still being written is skipped and reported as busy. Thanks to @aleps001 for reporting it (#556).

skillshare backup --cleanup --dry-run

Fixed: the list detail panel misses Agents

The Targets row in the skillshare list detail panel showed only Agents linked in merge mode with flat names. It now also lists Agents that receive the skill in copy or symlink mode or under standard or prefixed naming, and an agent's detail panel shows its Agents for the first time. A target with skills turned off, or a skill you disable with t, no longer lists a target.

skillshare v0.25.10 Release Notes

TL;DR

1. Open an Agent's MCP config folder from the dashboard. Each detected Agent on the MCP page has Open folder next to Open in editor and Copy path, so any program can open the file without setting $EDITOR.
2. A project's MCP files on its MCP tab. Projects → project → MCP now lists that project's Agent files with the same buttons.

New: Open folder on the MCP page

0.25.9 added Open in editor, which picks $VISUAL or $EDITOR, then an installed GUI editor, then the system default. To use an editor of your own choice, such as Notepad++ when VS Code is also installed, you had to set $EDITOR.

Open folder skips that. It opens the folder that holds the Agent's MCP config file, such as opencode.json or .cursor/mcp.json, in the file manager: Finder on macOS, File Explorer on Windows, the default handler on Linux. Open the file from there in any program.

• Before the Agent has written its file, it opens the closest folder that exists, so the button also shows for an Agent detected only by its settings folder.
• Like Open in editor, it starts on the machine running the dashboard, so it shows only when the browser runs there too: at localhost or through SSH port forwarding, not through a LAN address or a reverse proxy.
• SKILLSHARE_HEADLESS=1 refuses it, as it refuses the editor.

New: a project's MCP files on its MCP tab

On the Projects page, each project's MCP tab now has an Agents list on the right. It shows:

• the project's Agents,
• the Agents its own servers go to, even before the first sync writes their files,
• any other Agent whose file is already in the project.

Each row shows the file name and Copy path. On the dashboard's machine it also has Open folder and, once the file exists, Open in editor. A viewer elsewhere still sees the list and can copy paths.

skillshare v0.25.9 Release Notes

TL;DR

1. Open an Agent's MCP file from the dashboard. The MCP page has an Open in editor button for each detected Agent's config file.
2. Commands keep YAML anchors, aliases and merge keys in config.yaml. A skillshare target edit no longer expands &shared / *shared or <<: *base.
3. sync -p no longer rewrites the project config when nothing moved. A stale record could pull every remote install in a shared source into the project's skills: list.
4. Pi extension rules that depend on the Pi version show as unknown, and Open in editor accepts a quoted editor path in $EDITOR.

New: open an Agent's MCP file from the MCP page

Each detected Agent on the dashboard's MCP page now has Open in editor next to Copy path. It opens that Agent's MCP config file, such as opencode.json or .cursor/mcp.json, with the same editor a skill's Open in editor uses: $VISUAL or $EDITOR, then an installed GUI editor, then the system default.

• The button shows only for files that exist.
• The editor starts on the machine running the dashboard, so the button shows only when the browser runs there too: at localhost or through SSH port forwarding, not through a LAN address or a reverse proxy.

Fix: anchors, aliases and merge keys survive config writes

0.25.5 made commands keep the comments in config.yaml. Anchors were still expanded. After this, with the config below, b got its own copy of the list and stopped following a:

skillshare target a --add-exclude 'old-*'

targets:
  a:
    skills:
      path: /tmp/a
      include: &shared
        - demo
  b:
    skills:
      path: /tmp/b
      include: *shared

Anchors and aliases under targets and projects are now kept, and so are merge keys:

targets:
  claude:
    skills: &copy
      path: ~/.claude/skills
      mode: copy
  cursor:
    skills:
      <<: *copy
      path: ~/.cursor/skills

• Editing the anchored value still reaches every alias and every mapping that merges it, including a key added to or removed from it.
• A command that changes only an aliased or merged copy gives that copy its own value and leaves the anchor alone.
• Comments on aliases and merge-list items are kept.
• Still written out in full: a merge source written inline without an anchor (<<: {a: 1}) and anchors defined inside one.

Fix: sync -p leaves the project config alone when nothing moved

Since 0.25.5, sync looks for skills you moved by hand. In project mode, a .metadata.json record whose folder you deleted started that search, and the search then added every remote install in the source folder to the project's skills: list, .gitignore and skills.lock.json. This hit projects whose skillshare/skills folder is also the global source.

Sync now writes entries only for skills it actually found moved. When none moved, the three files are not touched.

Fix: Pi extension rules that depend on the Pi version

Pi 1.2.0 rewrites some resource-filter patterns before matching, while older Pi compares them as written:

Skillshare cannot tell which Pi reads the rules, so the dashboard's Pi extensions list now marks an extension decided by such a pattern as unknown and names the pattern, instead of guessing whether it loads. Exact rules also follow Pi's normalization now: a leading .\ is dropped, and \ becomes / on Windows.

Fix: quoted editor path in $EDITOR

Open in editor now accepts a quoted path with spaces in $VISUAL or $EDITOR, so an editor that is not on PATH works on Windows:

$env:EDITOR = '"C:\Program Files\Notepad++\notepad++.exe"'

skillshare v0.25.8 Release Notes

TL;DR

1. Oh My Pi plugins install from GitHub and other Git sources on macOS. 0.25.7 accepted newer OMP versions, but on macOS every Git-source install to OMP was still refused.

Bug fix: OMP installs from Git sources on macOS

On macOS, adding a plugin from a Git source to Oh My Pi failed with:

The reviewed OMP runtime destination must be verified empty. Nothing was installed or replaced.

The runtime destination was not the problem. Skillshare clones the source into the system temp folder, which on macOS sits under /var, a link to /private/var. The OMP install check refuses any linked folder on the path, and it refused Skillshare's own temp clone. A local plugin folder under a linked parent folder was refused the same way.

Sources are now read through their real path, so this works again:

skillshare plugin add https://github.com/ayghri/i-have-adhd --target omp -g

• Links inside a plugin source are handled as before.
• The source recorded in your config does not change.
• Linux was not affected, because /tmp is not a link there.

skillshare v0.25.7 Release Notes

TL;DR

1. Oh My Pi plugins install, remove and select extensions on any OMP 18.6.1 or later, not only on exactly 18.6.1.
2. The plugin update dialog keeps long plugin names readable when a plugin goes to several Agents.

Bug fix: OMP releases after 18.6.1 were refused

Skillshare pinned Oh My Pi to exactly 18.6.1. On any newer release, such as 18.8.7, adding a plugin to OMP failed with:

Installation requires OMP 18.6.1, a reviewed source and a verified cache root. Nothing was changed.

Removing an OMP plugin and editing standalone extension selection were blocked the same way.

The version check is now a minimum: any OMP 18.6.1 or later is accepted.

skillshare plugin add ./my-plugin --target omp -g
skillshare plugin remove my-plugin --target omp -g

• The OMP sources these features rely on (plugin cache, registry, omp plugin output, project anchor, extension loading and the native file lock) are unchanged from 18.6.1 through 18.10.2. Install and removal were also run against a real OMP 18.8.7.
• Older, prerelease and unrecognized versions stay blocked, and nothing native is changed.
• Native OMP upgrade stays blocked, as before, because it can replace cache files other projects still use.

Dashboard

• Readable plugin update rows. In the Update N dialog, a plugin installed to several Agents squeezed its name next to the Agent labels and versions. The name now has its own line, Agent labels and old → new versions wrap, and the row status no longer pushes them aside.

skillshare v0.25.6 Release Notes

TL;DR

1. Updating many plugins from the dashboard runs as one server-side batch, faster and safe to close the page on.
2. Shared memory shows on the dashboard, and Memory tools give your agent prompts to try, review and dream over it.
3. Turning off a global MCP server in one project works in OpenCode 2, and plugins sync to OpenCode 2.
4. An imported Claude plugin updates without a version mismatch error.
5. Prefixed naming no longer skips skills whose name: differs from their folder.

Batch plugin updates

The Update N dialog on the Plugins page used to preview and apply each plugin with its own round trips, clone each source again, and reload the config after every plugin. It now sends the picks to the server in one run:

• Each plugin is previewed once and that plan is applied. Plugins from the same source share one read of it, and the config reloads once at the end.
• Stop after this one lets the plugin under way finish and starts no other. Closing the page does not cut an install short.
• Rows show old → new per Agent. A row an interrupted run never finished is marked failed. When everything is current, the dialog lists each plugin with its Agent and version.
• An Agent whose source moved since the check, or that the check did not show, installs nothing. An npm package in Pi is the exception, since Pi installs whatever npm names latest; it is no longer flagged as moved on every update.

Shared memory

Once memory is created in Extras → Memory, the Dashboard → Memory section shows up to four recently updated notes, and clicking one opens it. Update times come from the note file, so edits made outside Skillshare count too; untouched starter notes are shown apart. The Memory tab shows the note count and latest update, and the browser remembers Expand/Collapse across notes and reloads.

Use with agents → Memory tools, also opened from the dashboard Memory section, copies prompts for your own agent to run:

• Try across sessions writes a test line to INDEX.md, checks from a fresh conversation that the note is read, then removes the line.
• Review this session proposes reusable lessons from corrections and repeated mistakes in the current conversation, after checking existing project docs and checks, ranked by impact.
• Dream compares saved notes across sessions for recurring patterns and for duplicate, stale, contradictory or broken-link notes.

Every change is proposed with paths and before/after text and waits for your approval. Writes go through version-checked Skillshare CLI commands with backups, and the tools stay disabled until the memory source is confirmed. With the updated built-in skill, you can ask your agent to review the session or dream directly. Skillshare never runs, launches or schedules an agent, and never reads private conversation history.

OpenCode 2

OpenCode 2 replaces a global MCP server with the project entry of the same name, and drops an entry without its type and command or url. The {"enabled": false} that Skillshare wrote for a disabled server under mcp.projects was therefore ignored, and the server stayed on.

mcp:
  projects:
    ~/work/app:
      servers:
        company-docs:
          disabled: true
          targets: [opencode]

• When the global config defines the server, the project entry now also carries its type and executable name, or its URL's scheme and host. OpenCode 1 and 2 both read it as off. Args, env, headers and the rest of the URL stay out of the project file, which may be committed.
• In project mode, or when the global config does not define the server, only the switch can be written, and sync says OpenCode 2 ignores it.
• To turn the server back on, remove the disabled entry and sync. Re-enabling it inside OpenCode starts it with only what the project file holds.
• Importing an OpenCode 2 config reads each server in mcp.servers and skips the mcp.timeout defaults, instead of listing servers as one broken server.

Plugins sync to OpenCode 2 too. It prints opencode v2.0.27 for --version, which Skillshare did not recognize, so plugin sync to OpenCode 2 was blocked and imported OpenCode plugins were never updated.

Fixes

• Imported Claude plugin updates. Updating a plugin imported from Claude failed with native update returned version 1.7.1; expected 1.7.0, because the check expected the version recorded at import. The marketplace decides that version, so the update now records what was installed. A plugin added from a reviewed source is still checked against the reviewed version.
• Prefixed naming. target_naming: prefixed rewrites name: in every copy, yet sync skipped a skill whose name: did not match its folder, so a tracked repo that is itself a skill could never sync. Only standard naming requires the match now. The dashboard's skipped-skills hint says whether skills were skipped for their name or for a folder collision.
• Sync Now after an update. The Updates tab offers Sync Now only when there are pending changes to sync; existing symlinks already read the updated source. A failed check shows the error with Retry instead of saying everything is up to date.

skillshare v0.25.5 Release Notes

TL;DR

1. skillshare move moves installed skills, or whole folders, to another folder and keeps their install records, so nothing is re-downloaded and uninstall, update and audit still know them.
2. The dashboard can move skills and folders too, with a preview, a clear reason when something is blocked, and a Sync now button at the end.
3. The install dialog lets you pick an existing folder or build a new one, and shows the link name you will get.
4. sync now adopts a skill you moved with mv, so the old habit keeps working: the record, audit acceptances and lock pin follow on the next sync.
5. Plugins update in one batch from the dashboard: the page checks on open, and one dialog updates everything that is behind, per Agent, with retry.

Move installed skills and folders

Until now, organizing installed skills into folders meant mv, which left the .metadata.json record at the old path: the next install or Install missing started over, and uninstall could not find the skill. skillshare move renames the folder and carries the record, the accepted audit findings, the project lockfile pin and config.yaml group, the project .gitignore line and a literal .skillignore line along with it.

skillshare move react-best-practices frontend      # one skill into frontend/
skillshare move pdf docx office                    # several skills
skillshare move frontend archive                   # a whole folder -> archive/frontend/
skillshare move archive/old-skill .                # back to the source root
skillshare move react-best-practices frontend -n   # preview
skillshare sync                                    # rename the links in your targets

• A move never syncs; it tells you to run skillshare sync. --json reports each name with a stable error_code, and -p works in project mode.
• Everything is checked before anything is renamed, and a folder moves whole or not at all. A skill or folder inside a tracked repo or below a followed source link is refused, as is a destination inside a skill or a tracked repo. A short name that matches several skills asks for the full path.
• A target name collision needs --force. A target include/exclude rule that decides differently for the new flat name is warned about, in either direction; config.yaml is not changed.
• install --into now refuses a folder inside a skill or a tracked checkout, with the same codes.

sync adopts a hand-moved skill

If you still reach for mv, the next sync finds the moved copy (same name, files unchanged since install, exactly one such copy) and moves its install record, accepted audit findings and project lock pin to the new path. Before, only install or Install missing did that, so update and uninstall lost the skill after mv + sync. sync never removes a record, and sync --dry-run adopts nothing. A .skillignore line still does not follow; use skillshare move for that.

Bug fix: config.yaml keeps its comments

Every command that wrote the config (target, config set, installing a tracked repo, and the matching dashboard actions) re-encoded the file and dropped its comments. Comments now stay on every key that is still present, so marker blocks such as # BEGIN … / # END … survive a skillshare target universal --mode copy. A comment on a key the command removed moves in front of the next key, so nothing is lost; key order and blank lines are still normalized (#525). registry.yaml keeps its comments the same way.

Dashboard

• Move to folder. Select skills and choose Move to folder…, or open a folder's menu and choose Move whole folder…; the skill page has the same entry. The dialog previews the new paths and link names, blocks a folder move when any item is refused and says why, offers Move anyway only for a name collision, and ends with Sync now.
• Pick an existing folder when installing. The Into folder field lists the source root and every existing folder with its skill count. New folder… opens a step that builds the path and shows the resulting link name before you confirm.
• Update plugins in one batch. The Plugins page checks for updates when it opens and shows old → new on each row. Update N opens one dialog with every plugin that is behind, ticked by default, per Agent. One button updates the picks in turn with a status per row, Stop after this one, and Retry for the Agents that failed. Imported installs Skillshare cannot update, and sources that no longer provide a compatible plugin, are listed apart. Results update the page, so there is no second check.