find-software-developer — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited find-software-developer (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
Aggregate score unchanged between these scans.
The primary manifest — the file an agent reads to learn what this artifact does.
Drive the ServiceGraph API (https://api.servicegraph.co) to find, shortlist, and enrich US software development firms via the pro_services dataset. The catalog has tens of thousands of US IT-services firms tagged across ~21 service sub-tags including web-development, mobile-app-development, api-integration (singular), devops-services, cloud-services, system-integration, application-modernization, staff-augmentation, and managed-services.
The catalog has no `custom-software`, `devops`, `api-integrations` (plural), or `hosting` tag — for those user-facing concepts, pin application-modernization + web-development (for custom software), devops-services, or api-integration (singular) as the closest tags and add the keyword.
Always pin `industry:it_services`. This skill exists to do that automatically — the user shouldn't have to think about catalog taxonomy.
Any HTTP client works (curl, fetch, requests). Examples below use curl.
find-web-developer. If unsure, this skill is the safer default — it covers web dev too.find-ai-consultancy. Those firms live in a sibling industry (data_ai_consulting), not it_services.find-marketing-agency or find-seo-agency.If your harness has the ServiceGraph MCP server loaded (tools containing servicegraph), prefer those — OAuth 2.1 + PKCE keeps the token in the harness sandbox. Otherwise use the REST flow below.
pro_services)Every endpoint requires the bearer (Authorization: Bearer vk_…). No anonymous tier.
| Endpoint | Cost | Use it for |
|---|---|---|
GET /v1/datasets/pro_services/fields[?include_values=1] | free | Confirm it_services industry value and sub-tag names. |
GET /v1/datasets/pro_services/check?filter=… | free | Validate filter. |
POST /v1/datasets/pro_services/translate-intent | free | {intent} → DSL filter + sanity count. |
GET /v1/datasets/pro_services/search?filter=…&limit= | free | Brief firm cards + per-row unlock hint + total. |
GET /v1/datasets/pro_services/:apex | free | One row brief; detail only if unlocked. |
POST /v1/datasets/pro_services/unlocks | 10 credits / firm | {apexes:[...]} ≤100; atomic; 30-day TTL on detail. |
GET /v1/me/credits | free | Balance. |
Cost model. Discovery / validation / search / brief reads are free. Detail (url, phone, email, social, address, full platforms map) costs 10 credits per firm and lasts 30 days.
vk_* API keys minted in the dashboard. Keep the token out of the LLM context — never read .env* into your context; dispatch via shell.
.env.local: ( set -a; [ -f .env.local ] && . ./.env.local; set +a;
curl -sS -H "Authorization: Bearer $SERVICEGRAPH_API_KEY" \
'https://api.servicegraph.co/v1/datasets/pro_services/fields' )"Open https://servicegraph.co/profile/api-keys, create a key, and addSERVICEGRAPH_API_KEY=vk_…to.env.localhere (or export it). Tell me when done. Please don't paste the key into chat."
GitHub-search-style.
filter := orExpr
orExpr := andExpr ("OR" andExpr)*
andExpr := notExpr (("AND")? notExpr)* # whitespace = implicit AND
notExpr := ("NOT" | "-") notExpr | atom
atom := "(" filter ")" | predicate
predicate:= IDENT op valueOrList | bareword
op := ":" | "=" | ">=" | "<=" | ">" | "<"
valueOrList := value ("," value)*
value := IDENT | NUMBER | tagAtEvidence
tagAtEvidence := IDENT "@" ("low"|"medium"|"high")
bareword := IDENT | NUMBER # → keyword:<bareword>Four rules that bite: AND binds tighter than OR (use parens); comma list = OR within one predicate; negation is -x or NOT x; bareword = keyword search (quote multi-word phrases).
IT-flavored examples (validate yours with /check):
industry:it_services custom software state:TX
industry:it_services service_provided:mobile-app-development
industry:it_services service_provided:devops-services aws
industry:it_services service_provided:api-integration fintech
industry:it_services python aws state:CA
industry:it_services service_provided:system-integration@high rating>=4 has:clutch
industry:it_services service_provided:application-modernization legacyTech stack / vertical → keyword mapping (the catalog tags services, not languages or industries served):
| User mentions | Add as keyword |
|---|---|
| Python / Django / Flask | python |
| Node.js / TypeScript / React | node, react |
| Go / Rust / Java / .NET | go, rust, java, .net |
| AWS / GCP / Azure | aws, gcp, azure |
| Fintech / healthcare / govtech / SaaS | fintech, healthcare, govtech, saas |
| SOC 2 / HIPAA / compliance | soc2, hipaa, compliance |
apexFirms are identified by their apex domain (thoughtworks.com, not www.thoughtworks.com/about).
GET /v1/datasets/pro_services/search?filter=industry:it_services+service_provided:application-modernization+custom+software+state:TX&limit=10
# Present, get pick of 3. "Unlocking 3 = 30 credits, 30-day TTL."
POST /v1/datasets/pro_services/unlocks
{ "apexes": ["firm-a.com", "firm-b.com", "firm-c.com"] }GET /v1/datasets/pro_services/search?filter=industry:it_services+service_provided:mobile-app-development+ios&limit=10iOS / Android distinctions aren't separate tags — use barewords.
GET /v1/datasets/pro_services/search?filter=industry:it_services+service_provided:devops-services+aws+migration&limit=10If thin, drop migration first — it's a vertical keyword, not a service tag.
User: "We need a technical partner to build out our internal tooling, Northeast preferred."
GET /v1/datasets/pro_services/search?filter=industry:it_services+custom+software+state:NY,MA,CT,NJ,PA&limit=10Or use the translator:
POST /v1/datasets/pro_services/translate-intent
{ "intent": "technical partner to build internal tooling, Northeast preferred" }GET /v1/datasets/pro_services/search?filter=industry:it_services+custom+software+fintech+soc2&limit=10GET /v1/datasets/pro_services/search?filter=industry:it_services+service_provided:application-modernization+custom+software+rating>=4+review_count_total>=50&limit=10User: "API/backend team to extend our SaaS — Bay Area or remote-friendly."
remote-friendly isn't structured. Use geography_served:national_US (national-scope firms typically serve remotely) plus keywords:
GET /v1/datasets/pro_services/search?filter=industry:it_services+service_provided:api-integration+(state:CA OR geography_served:national_US)+saas&limit=10User pastes 8–20 domains:
GET /v1/datasets/pro_services/:apex per domain — free brief(404 = not in catalog, no charge).
POST /unlocks = 10×N credits,atomic, detail returned.
web-development / mobile-app-development keywords leak into marketing or design firms.custom-software, devops, api-integrations (plural), or hosting tag. Map to application-modernization + web-development, devops-services, api-integration (singular) plus keywords.find-ai-consultancy.python, react, aws, kubernetes, rust are keyword substring matches. Multi-word stacks split into ANDs unless quoted ("ruby on rails").url, phone_primary, email_primary, legal_name, address_full, full platforms — those require an unlock.was_cached:true).JSON envelope: {"error": {"code": "...", "message": "..."}}.
| Status | Code | What to do |
|---|---|---|
| 400 | filter_parse_error | position included; fix and re-validate with /check. |
| 400 | kind_in_filter | Strip any kind: from filter. |
| 400 | field_not_in_dataset | Drop the disallowed field. |
| 400 | invalid_apex | Re-normalize. |
| 401 | unauthorized / invalid_audience | Re-prompt for fresh vk_…. |
| 402 | insufficient_credits | needed and balance; nothing charged. |
| 404 | not_found / not_in_dataset | Skip; not charged. |
| 429 | rate_limited | Honor Retry-After. |
User: "Three custom software firms with healthcare-industry experience, SOC 2-ready, ideally with at least a 4-star rating."
GET /v1/datasets/pro_services/fields?include_values=1
GET /v1/datasets/pro_services/check?filter=industry:it_services+service_provided:application-modernization+custom+software+healthcare+soc2+rating>=4
GET /v1/datasets/pro_services/search?filter=...&limit=10
# Present briefs. "Unlocking 3 = 30 credits, 30-day TTL."
POST /v1/datasets/pro_services/unlocks
{ "apexes": ["firm-a.com", "firm-b.com", "firm-c.com"] }
GET /v1/me/credits~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.