overleaf-sync — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited overleaf-sync (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Sync a local git clone of a shared Overleaf project: pull collaborators' latest, check whether Overleaf has moved ahead, or (only on explicit request) publish your local edits back — without ever erasing collaborators' work.
Overleaf exposes each project as a git remote (Overleaf menu → Sync → Git; paid feature). The shared project is cloned into a subfolder of your repo — `Overleaf/` by convention — which is its OWN git repo, separate from your project's repo.
origin = https://git.overleaf.com/<project-id>.olp_…), stored in the OS keychain viagit credential so pulls are non-interactive (username git, not your email).
Overleaf/:master — pristine mirror of Overleaf. Only ever updated by git pull. NEVER edit here.local-edits — where you edit offline.remote.origin.pushurl is set tono_push, so git push fails until deliberately re-enabled. Clone, fetch, and pull only READ from Overleaf and cannot change the shared project; only push writes.
Overleaf/ should be in your project's top-level .gitignore so the shared paperis never pushed to your personal repo. (See the one-time setup note at the end.)
/overleaf-sync [status|pull|diff|publish] — default action is status.
Use status/pull/diff freely (read-only w.r.t. Overleaf). Use publish ONLY when the user explicitly says to publish/push, and treat it as the one dangerous operation.
Overleaf/ exists and is a git repo: git -C Overleaf rev-parse --git-dir. If not,stop and point the user to the one-time setup at the end of this file; do not improvise.
-C Overleaf. If the project root path has spaces, quote it;the Overleaf clone dir itself should have no spaces.
status (default) — is Overleaf ahead? [read-only]git -C Overleaf fetch origin (non-interactive).master vs origin/master:git -C Overleaf rev-list --left-right --count master...origin/master.
origin/master is ahead, list the new commits(git -C Overleaf log --oneline master..origin/master) and the changed files (git -C Overleaf diff --stat master origin/master).
Output e.g.: "Overleaf is 2 commits ahead; main.tex changed (+34/-1). You are on local-edits (clean). Run /overleaf-sync pull to update the mirror." Make NO changes.
pull — update the local mirror from Overleaf [read-only w.r.t. Overleaf]git -C Overleaf fetch origin.master is behind: fast-forward it — git -C Overleaf fetch origin master:masterif not currently on master, else git -C Overleaf pull --ff-only. Never a non-ff pull.
local-edits and master advanced, OFFER (do not auto-run) toupdate their branch: git -C Overleaf rebase master (or merge master). Let them choose. Never touches Overleaf.
diff — show differenceslocal-edits vs master: git -C Overleaf diff master..local-edits -- <file> (yourunpublished edits).
status first, then git -C Overleaf diff master origin/master.Pick based on the user's wording; default to "what are my unpublished edits" (local-edits vs master).
publish — send local edits to Overleaf [WRITES to the shared project — DANGEROUS]Do NOT run any step past 3 without an explicit, in-this-turn "yes, publish" from the user. Never use --force/-f. The merge step is the guard against erasing others' work.
Get explicit confirmation before proceeding.
local-edits is committed: if the tree is dirty, show git -C Overleaf statusand commit with the user's message (author: the user; NO Co-Authored-By trailer).
git -C Overleaf checkout master && git -C Overleaf pull --ff-only — grab everyone'snewest first. (If this isn't a fast-forward, STOP — the mirror diverged; investigate.)
git -C Overleaf merge --no-ff local-edits. If git reports CONFLICTS: STOP, show theconflicted files, and have the user resolve them — never auto-resolve, never overwrite.
git -C Overleaf diff origin/master..master --statand the relevant hunks. Get a final go-ahead.
git -C Overleaf remote set-url --push origin "$(git -C Overleaf remote get-url origin)"git -C Overleaf push origin mastergit -C Overleaf remote set-url --push origin no_push ← restore the safetygit -C Overleaf checkout local-edits. Confirm the push succeeded and push is disabled again.overleaf-sync [action]: <one-line result>
branch: <current> (clean|dirty)
mirror vs Overleaf: <N ahead / M behind>
[changed files / next suggested action]status, pull, diff never write to Overleaf. publish is the only writing path andneeds explicit per-invocation confirmation.
git push --force. Never resolve merge conflicts on the user's behalf.pushurl=no_push) after finishing.re-store the new olp_… token in the keychain (do NOT put the token in a URL or commit it):
printf "protocol=https\nhost=git.overleaf.com\nusername=git\npassword=<token>\n\n" | git credential approveRun from your project root. Replace <project-id> and <token> with your own.
# 1. Store the Overleaf git token so pulls are non-interactive (macOS/Linux keychain):
printf "protocol=https\nhost=git.overleaf.com\nusername=git\npassword=<token>\n\n" \
| git credential approve
# 2. Clone the shared project into Overleaf/ (its own repo, NOT a submodule):
git clone https://[email protected]/<project-id> Overleaf
# 3. Create the editing branch and disable accidental pushes:
git -C Overleaf branch local-edits
git -C Overleaf remote set-url --push origin no_push
# 4. Keep the shared paper out of your personal repo:
echo "/Overleaf/" >> .gitignoreAfter this, /overleaf-sync works. Edit on local-edits; master stays a clean mirror.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.