talent-sync — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited talent-sync (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Upload the local Talent-Augmenting OS profile to the hosted web app so the user can view it in the dashboard and so the remote MCP endpoint can serve it.
"Hi: I'll push your local TAOS profile up to the hosted app so it shows up in your dashboard. One moment."
profiles/pro-*.md, profiles/tal-*.md, ~/.talent-augmenting-layer/profiles/pro-*.md, ~/.talent-augmenting-layer/profiles/tal-*.md. If multiple, ask the user which one. If none, say: "I couldn't find a local profile. Run /talent-augmenting-layer:talent-assess first, then come back." and stop.~/.talent-augmenting-layer/auth.json. The file should look like: {"token": "eyJ...", "base_url": "https://proworker-hosted.onrender.com"}"I need an access token to sync. Please: 1. Open https://proworker-hosted.onrender.com/cli-token in a browser. 2. Sign in with Google if prompted. 3. Copy the token shown on the page. 4. Paste it here.
>
The token is a session JWT valid for 72 hours. I'll cache it at ~/.talent-augmenting-layer/auth.json for reuse."Wait for the user to paste the token. Trim whitespace. Write ~/.talent-augmenting-layer/auth.json with the token and base_url.
{base_url}/api/profile/sync via curl: curl -sS -X POST "$BASE_URL/api/profile/sync" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d @<(jq -nc --rawfile content "$PROFILE_PATH" '{content_md: $content, scores_json: "{}"}')If jq is not installed, fall back to inline JSON:
python3 -c 'import json, sys; print(json.dumps({"content_md": open(sys.argv[1]).read(), "scores_json": "{}"}))' "$PROFILE_PATH" \
| curl -sS -X POST "$BASE_URL/api/profile/sync" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
--data-binary @-{"version": N, "message": "..."}, tell the user: "Synced. You're now on version N. View it at {base_url}/dashboard."401 Unauthorized, delete the cached token (rm ~/.talent-augmenting-layer/auth.json) and restart from step 4 once.TAL_HOSTED_URL: override the default https://proworker-hosted.onrender.com.TAL_HOSTED_URL=http://localhost:8000.scores_json is sent as an empty object unless the profile markdown has a ## TAOSQ Scores block the skill can parse into JSON. Add that later if needed.Keep it short. If sync succeeds in one round, just say "Synced to version N."
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.