Agent skill · Audited from source

sync

skill · javascript-mastery-pro/skillsMIT licenceAudited 29 Oct 2026 · source 60318dc84d13

★ 1,561pushed 80 days ago
✓SAFEGrade B · 89/100 · 29 Oct 2026 · 60318dc
1,561repo stars · whole javascript-mastery-pro/skills

Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 60318dc84d13 and found no filesystem, network or shell access and no hard-coded secrets. What it does: Run /sync as the last step after a change is complete, around merge, to keep durable knowledge current. Updates root and nested AGENTS.md, reconciles the scope from repo evidence, and flags specs the change made stale.…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “sync (javascript-mastery-pro/skills)”. Retrieved 29 Oct 2026. https://modelsatlas.com/skills/javascript-mastery-pro/sync

2 skills are called “sync”. You are viewing javascript-mastery-pro/skills.

Trust audit

Audit 0.4.1 · source read 29 Oct 2026

Trust score89/100✓SAFE B
0 critical0 high0 medium0 low0 info

SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 13,985 of 14,816 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkNone observedNo outbound calls in the source
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS0
L1 Static sourceSecrets, path traversal, supply chain, hidden codeNA0
L2 InstructionsPrompt injection, authority framing, hidden directivesPASS0
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (0)

No findings at any severity. We re-audit when the source changes.

Audit 0.4.1 · source sha 60318dc84d13 · 29 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisherjavascript-mastery-pro GitHub organizationOwner of the repository this skill is read from
  • Source folderjavascript-mastery-pro/skills/skills/syncThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdict60318dc84d13A new audit runs when the source changes
  • Repository statusNot archivedLast push 80 days ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Run /sync as the last step after a change is complete, around merge, to keep durable knowledge current. Updates root and nested AGENTS.md, reconciles the scope from repo evidence, and flags specs the change made stale.…

---
name: sync
allowed-tools: Bash, Read, Grep, Glob, Write, Edit, Agent
description: "Run /sync as the last step after a change is complete, around merge, to keep durable knowledge current. Updates root and nested AGENTS.md, reconciles the scope from repo evidence, and flags specs the change made stale. Surgical edits only: it adds lines, and rewrites single lines it owns. Never a whole section, never curated prose."
---

## Output style (plain words, no dashes, no hyphens)

<!-- OUTPUT-STYLE:START -->
Write everything this skill produces, files and messages alike, in plain simple language. Talk to the reader as `you`, warm and direct like a colleague, and present every step as a recommendation they may run or skip, never an order. Keep technical terms that carry real meaning; explain each in plain words. Never use a dash or a hyphen as punctuation: no em dash, no en dash, and no hyphenated compounds. Write `read only`, not `read-only`. Say it in simple words, or reword the sentence. Code, file paths, command flags, and values other skills match on keep their hyphens. Use short sentences, commas, or parentheses. Clear beats clever.
<!-- OUTPUT-STYLE:END -->

## What this skill does

Closes the loop on a completed change: syncs AGENTS.md files, the scope, and linked spec `**Status**:` lines to what the repo now shows, and flags what it must not edit (stale specs, curated prose). The Boundaries table below is the exact contract.

**`agent-prompt.md`** is the single source of truth for the maintenance rules; SKILL.md covers only orchestration. The main thread reads it and does the maintenance itself (see Step 3).

**Canonical file:** durable context lives in the tool agnostic **`AGENTS.md`**; **`CLAUDE.md` is only a pointer** to it. /sync edits/creates both, treating them only as targets, never as a change source.

## Boundaries

| Action | /sync | Owner |
|---|---|---|
| Edit existing root/nested AGENTS.md | ✅ maintains | /sync |
| Reconcile root AGENTS.md's `## Build approach` line to the scope header's approach (surgical single line edit, like the stack) | ✅ maintains; flags a curated divergence | /sync |
| Add a one line pointer to `design.md` (the UI design system) in the nearest AGENTS.md when a change establishes one | ✅ maintains (pointer only) | /sync |
| Create nested `<area>/AGENTS.md` for an area **net new in this change** | ✅ creates (diff = full area context) + adds root pointer | /sync |
| Create nested doc for an **already existing** undocumented area (only sliced by the diff) | ❌ flags "run /audit" | /audit |
| Create or restructure the **root** AGENTS.md | ❌ flags "run /audit" | /audit |
| Reconcile a spec's `**Status**:` line to its feature's scope status (`planned`→`Proposed`, `in-progress`→`In Progress`, `done`→`Accepted`; an `Assumed` spec is the exception: leave it `Assumed` and surface it, never reconcile it to `Accepted`) | ✅ Status line only | /sync |
| Clear an `Assumed` spec (move it out of `Assumed`) | ❌ flags as decision debt "run /architect to ratify" (never reconciled to the feature status; only ratification clears it) | /architect |
| Edit a spec's **content** / supersede it | ❌ flags as stale | /architect |
| Reconcile the scope, for the **relevant workspace's** scope file only (not all of `docs/scope/`), tick **any** completed sub task from repo **evidence** (code, tests, AGENTS.md), advance status | ✅ corrects | /sync |
| Add / reorder features or sub tasks in the scope | ❌ leaves alone | /scope |
| Overwrite or rewrite curated AGENTS.md prose | ❌ flags conflict instead | human |

The dividing line on creation is **context, not policy**: create only when this change shows you the whole area; defer to /audit when the area predates the change and you've seen only a slice. When unsure, **flag instead of creating**.

## Asks vs acts

**Acts.** Pauses only when there is **nothing to sync** (empty change set). Every edit to curated files is listed in the report so you can review or revert.

## Artifact ownership

Owns exactly what the Boundaries table grants and writes nothing else. As the **universal sub task reconciler** it ticks any scope sub task it can verify from repo evidence (sweeping the `/test`/`/audit`/`/sync` sub tasks other skills don't tick) and advances feature status; exact rules in `agent-prompt.md`.

**Artifact base.** specs and the scope live under `docs/` by default, or `.workflow/` if `docs/` is a published docs site; use whichever base exists in the repo (paths here assume `docs/`).

---

## Portability (any OS, any agent)

- **Commands**: `git` is the only required CLI and behaves the same on every OS, run the `git` lines as shown. Other shell snippets are POSIX **reference**, not literal scripts: don't assume `find`, `grep`, `sed`, `cat`, `test`/`[ ]`, `ls`, or `xargs` exist; use your agent's cross platform file tools and apply branching logic yourself rather than shell `if`/variables/redirects.
- **Bundled files**: referenced by paths relative to this skill's folder. Resolve the folder to an absolute path (you already resolve these relative paths) and read `agent-prompt.md` yourself at write time (Step 3), not during the earlier steps.
- The whole maintenance runs inline on the main thread, following the exact rules in **`agent-prompt.md`** (authoritative).

## Execution

### 1. Scope the change set (cheap, with per file status)

**Freshness first (teams):** `git fetch --quiet`; if `git rev-list --count HEAD..origin/$BASE` > 0 you are behind `origin/$BASE`, warn the engineer to pull first, a teammate may have already synced these docs.

Base: `main` if `git rev-parse --verify main` succeeds, else `master`. Current branch: `git rev-parse --abbrev-ref HEAD`. Use `--name-status` (not `--name-only`); the net new area and orphan cleanup logic need **A**dded vs **M**odified vs **D**eleted per file.

- Current branch **is** the base, mode `uncommitted`: `git diff --name-status HEAD`.
- Otherwise, mode `branch`: `git merge-base "$BASE" HEAD`, 

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 60318dc

Download folder ↗
git clone https://github.com/javascript-mastery-pro/skills
git -C skills checkout 60318dc84d13

The author documents no install command, so this uses the repository directly. Our verdict covers commit 60318dc84d13 only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
Claude CodeMentioned in its text, not testedSkills for Claude Code · About Claude Code
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. ✓SAFE B 89 / 100

    first audit · source 60318dc84d13

README badge

For maintainers · shows the latest audit

ModelsAtlas: SAFE BMODELSATLASSAFE · B
[![ModelsAtlas: SAFE B](https://modelsatlas.com/skills/javascript-mastery-pro/sync/badge.svg)](https://modelsatlas.com/skills/javascript-mastery-pro/sync/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

test!CAUTION

javascript-mastery-pro/skills

Run /test to write a test suite for code you just built or changed, after implementing a feature, route, or fix. Targets uncommitted changes automatically, reads test preferences.json for your framework (asks and saves…

★ 1.6kGrade B
scope✓SAFE

javascript-mastery-pro/skills

Run /scope to turn a product idea into a living, coarse scope in docs/scope/ and keep it current: plan a new product, plan the next slice, enroll one named feature, or run with no argument to reconcile after shipping…

★ 1.6kGrade B
imprint✓SAFE

javascript-mastery-pro/skills

Run /architect when choosing between approaches, designing a feature or page, picking a tech stack, or when /develop says a decision is owed, anytime a load bearing technical decision is unmade. Asks deep questions,…

★ 1.6kGrade B
document✓SAFE

javascript-mastery-pro/skills

Run /document `pr` | `changelog` | `release-note` | `postmortem` (or let it ask) to write the human facing prose about a change. Drafts from the real commits and diff, writing to the right place. Does not write code,…

★ 1.5kGrade B
develop✓SAFE

javascript-mastery-pro/skills

Run /develop to build a feature, UI or backend, from an approved design, a page, component, API, service, or data slice. If something load bearing is undecided and no spec records it, it stops and routes you to…

★ 1.5kGrade B
debug✓SAFE

javascript-mastery-pro/skills

Run /debug to find and fix a bug's root cause: a test failing for an unclear reason, /check verify finding a failure, or behavior being wrong. Runs a reproduce, localize, hypothesize, test, fix, verify loop, makes the…

★ 1.5kGrade B

Add this badge to your README

[![ModelsAtlas: SAFE B](https://modelsatlas.com/skills/javascript-mastery-pro/sync/badge.svg)](https://modelsatlas.com/skills/javascript-mastery-pro/sync/)

Questions about sync

What does the sync skill do?
Agentic Development skills behind the JS Mastery workflow
Is sync safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can sync access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
Which assistants does sync work with?
Its documentation mentions claude-code. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (60318dc84d13), read on 2026-10-29. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.