talent-pull — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited talent-pull (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Fetch the user's profile from the hosted web app and drop it into the local cache that the TAOS SessionStart hook scans on every new session.
Plugin-install users create their profile on the hosted side (via the web assessment or the remote MCP). Their profile lives in Postgres at proworker-hosted.onrender.com. But the SessionStart hook in plugin/hooks/inject-tal-layer.py only checks local filesystem paths. Without /talent-pull, ambient coaching falls through to "no profile found" every session.
After running /talent-pull once, the profile is cached locally and the hook finds it on all subsequent sessions. Re-run any time you updated the profile on the hosted side and want the local cache refreshed.
"Hi: I'll pull your hosted TAOS profile down into the local cache so the ambient coach picks it up from turn one. One moment."
~/.talent-augmenting-layer/auth.json. Expected shape: {"token": "eyJ...", "base_url": "https://proworker-hosted.onrender.com"}"I need an access token. Open https://proworker-hosted.onrender.com/cli-token in a browser, sign in with Google, copy the token, and paste it here."
Wait for the paste, trim whitespace, write ~/.talent-augmenting-layer/auth.json.
{base_url}/api/profile with Authorization: Bearer {token}: curl -sS "$BASE_URL/api/profile" -H "Authorization: Bearer $TOKEN"version, created_at, scores, content_md.404: "No profile on the hosted side. Run /talent-augmenting-layer:talent-assess first (either locally or at {base_url}/assess), then try again."401: delete the cached token and restart from step 2 once.Name from the profile's Identity Card section (line matching | **Name** | <value> |). Fallback: use the authenticated user's email from the /api/auth/token endpoint. Lowercase, kebab-case, e.g. pro-angelo.md.~/.talent-augmenting-layer/profiles/ exists (mkdir -p).content_md to ~/.talent-augmenting-layer/profiles/pro-{name}.md. Overwrite if present.~/.talent-augmenting-layer/profiles/pro-{name}.md. Ambient coaching will pick it up on next session."TAL_HOSTED_URL: default https://proworker-hosted.onrender.com. Pilot testers can point at a local dev server with TAL_HOSTED_URL=http://localhost:8000.Run whichever matches where the user is editing the profile. Running both on the same machine risks version drift; tell the user to pick one side as canonical for now.
Keep the report terse. If the pull succeeded in one round, just say "Pulled version N; run a fresh session to see ambient coaching pick it up."
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.