user-profile — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited user-profile (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Most skills in this bundle work better when they know who the user is. Right now they don't — every session starts from a blank slate, and the user re-establishes context the skills already could have known. This skill creates a single anchor file that carries the user's standing context, which other skills read automatically when present.
The file lives at ~/bettersense-work-reflections/profile.md (configurable via $BETTERSENSE_WORK_REFLECTIONS_HOME). Same private root as the rest of the reflection bundle. Same .gitignore. Same privacy posture.
Trigger this skill when the user:
Skip when:
Single markdown file with frontmatter + sections. Designed to be hand-editable (the user owns it; this skill just helps create and update).
---
name: [User's name, optional]
last_updated: 2026-05-03
default_hat: pm
---
# Default profile
## Role
[One paragraph: current role, level, time in role, who you report to in shape (e.g. "Sr PM, 3 years in role, report to a Director of Product who reports to the VP of Product").]
## Org and product context
[Company size and stage, product or area you own, team size, who your primary cross-functional partners are.]
## Current strategic focus (next 1-2 quarters)
[2-4 bullets: the things you're spending most of your time on. Not a backlog — the *narrative arc* you're trying to advance.]
## Communication style preferences
[How you like outputs framed. E.g. "Concise, no marketing buzzwords, direct over diplomatic, examples over abstractions, push back on me if my framing is off."]
## What I'm working on as a leader
[1-2 areas of personal growth — connects to `self-reflect`. Composes with coaching, performance management, etc.]
## Stack and tools (if relevant)
[Languages, frameworks, observability stack, etc. Useful for `the-spec-writer`, `the-eval-designer`, `the-rfc-reviewer`, `the-prompt-critic`.]
## Cross-references
- Stakeholder files: `~/bettersense-work-reflections/managing-{up,across,down,teams}/`
- Self-reflection: `~/bettersense-work-reflections/self/reflections.md`
- Wins log: `~/bettersense-work-reflections/wins.md`
---
# Alternate hats (optional)
## Hat: TPM mode
[Used when running cross-team programs. Captures any context that differs from default — usually different stakeholders, different KPIs, different communication register.]
## Hat: IC mode
[For users who do both manager and IC work. Captures what the IC work involves, who your collaborators are when you're in this mode.]The "alternate hats" section is optional. Most users have one mode; some wear multiple. The skill should ask whether the user wants alternates only if they bring it up.
If the user says "stop", "exit", "I'm done", "skip this", "pause", or similar — stop immediately. Briefly summarize what was captured so far, offer to save a partial profile if enough was gathered, and end cleanly. Don't ask follow-up questions or push for completion.
In the opening message, after explaining what this skill will do, add one short sentence: "You can say 'stop' at any time and we'll wrap up with whatever we have."
When invoked for first-run creation, walk through these in order. Keep each step short — this is a doorway, not an interrogation. The user fills detail over time.
After capture, write the file. Confirm with the user before writing — show them the rendered profile and ask if anything is off.
When invoked for an existing profile, three sub-modes:
Always update the last_updated date in frontmatter when writing.
The convention (also referenced in the README's anchor-file pattern section):
If `~/bettersense-work-reflections/profile.md` exists, read it before doing your work. Use the role, level, communication style, current strategic focus, stack, and any other relevant fields to tailor your output. Don't repeat questions the profile already answers.
Skills currently designed to read the profile when present:
the-spec-writer — spec format, scope assumptions, stack defaultsthe-translator — audience defaults, framing registerthe-explainer — audience preferences, voicereport-promo-case — level calibration (what bar to argue against)report-career-architect — pacing and plausibility (a Director-level user designs different growth plans than a first-time manager)metrics-design — product/area context for KPI framingcoaching-mode — user's leadership style (sets default tone for coaching prompts)feedback-frameworks — user's directness preferenceWhen in doubt about whether a skill should read it: yes, and tailor the output. The skill body always has the right structure; the profile makes it land in the user's voice.
If the profile is missing, the skills work without it — just produce more generic output. Don't pester the user to set it up unless they raise the question.
A user who wears multiple roles (PM + EM, TPM during programs + senior IC otherwise, or one PM hat per product line) can capture each as a section under "Alternate hats."
When a user invokes a skill, the skill defaults to the default_hat from frontmatter unless the user explicitly indicates a different mode ("use my TPM hat for this"). The skill should be light on this — most invocations don't need to ask which hat; it'll be obvious from the context.
user-profile for any reason, gently surface: "Your profile was last updated 2026-02-04. Anything material changed?" Don't nag.self-reflect. Wins belong in the wins log. The profile is standing context, not active record.user-profile owns the creation of ~/bettersense-work-reflections/, the .gitignore, and the privacy warning. On first run, if the root directory doesn't exist, create it and the .gitignore, then issue the privacy warning before writing the profile file:I'm about to create~/bettersense-work-reflections/, which will hold your profile and any candid reflections you log over time. This directory lives on your local machine only. Confirm the location, or set$BETTERSENSE_WORK_REFLECTIONS_HOMEif you'd prefer a different one (e.g. an encrypted volume).
Wait for confirmation before proceeding. If the directory already exists, skip creation and the warning entirely — the ceremony only needs to happen once.
stakeholders.json is for. Cross-reference instead.self-reflect sessions, the user may want to update the profile's growth area to reflect what's surfaced.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.