Agent skill · Audited from source

Onboarding

skill · huytieu/COG-second-brainMIT licenceAudited 14 Oct 2026 · source 6ea1a6ff2160

★ 1,281pushed 11 days ago
✓SAFEGrade B · 89/100 · 14 Oct 2026 · 6ea1a6f
1,281repo stars · whole huytieu/COG-second-brain

Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 6ea1a6ff2160 and found no filesystem, network or shell access and no hard-coded secrets. What it does: Personalize COG for your workflow - creates profile, interests, and watchlist files with guided setup (run this first!)

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Onboarding (huytieu/COG-second-brain)”. Retrieved 14 Oct 2026. https://modelsatlas.com/skills/huytieu/onboarding

2 skills are called “Onboarding”. You are viewing huytieu/COG-second-brain.

Trust audit

Audit 0.4.1 · source read 14 Oct 2026

Trust score89/100✓SAFE B
0 critical0 high0 medium0 low0 info

SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 13,985 of 14,816 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkNone observedNo outbound calls in the source
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS0
L1 Static sourceSecrets, path traversal, supply chain, hidden codeNA0
L2 InstructionsPrompt injection, authority framing, hidden directivesPASS0
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (0)

No findings at any severity. We re-audit when the source changes.

Audit 0.4.1 · source sha 6ea1a6ff2160 · 14 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisherhuytieu GitHub userOwner of the repository this skill is read from
  • Source folderhuytieu/COG-second-brain/.claude/skills/onboardingThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdict6ea1a6ff2160A new audit runs when the source changes
  • Repository statusNot archivedLast push 11 days ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Personalize COG for your workflow - creates profile, interests, and watchlist files with guided setup (run this first!)

---
name: onboarding
description: Personalize COG for your workflow - creates profile, interests, and watchlist files with guided setup (run this first!)
roles: [all]
integrations: []
---

# COG Onboarding Skill

## Purpose
Welcome new users and collect essential information to personalize their COG experience. All configuration is stored as natural markdown files within the vault structure, following COG's philosophy of transparent, editable knowledge.

## When to Invoke
- User explicitly requests `/onboarding` or mentions "onboarding" or "setup COG"
- User is new and hasn't completed onboarding yet
- User wants to update their profile or add new projects
- Any time profile customization is needed

## Core Design Principle: Smart, Low-Friction Onboarding

**The onboarding MUST feel like a natural conversation, NOT a form to fill out.**

Key rules:
- **Ask open-ended questions, not option-pickers.** Never present numbered lists of choices for the user to pick from.
- **Ask as few questions as possible.** Infer what you can from context and the user's natural responses.
- **Never ask redundant questions.** If you can extract the answer from something the user already said, don't ask again.
- **Parse intelligently.** If someone says "I'm Alex, a PM at a fintech startup tracking Stripe and Plaid", extract: name=Alex, role=PM at fintech startup, watchlist=[Stripe, Plaid]. Don't ask follow-up questions for info already given.
- **Confirm, don't re-ask.** If you're unsure about something the user said, confirm your interpretation rather than asking the question fresh.

## Process Flow

### 1. Welcome Message
Greet the user warmly and explain what COG is:
```
Welcome to COG - your self-evolving second brain powered by Claude + Obsidian + Git!

COG helps you capture thoughts, get daily intelligence briefings, and build knowledge over time - all stored as simple markdown files you own.

Let's get you set up. Tell me a bit about yourself - your name, what you do, and what topics or areas you're most interested in staying sharp on. Feel free to share as much or as little as you'd like.
```

**This single open-ended prompt replaces the old sequential questions.** The user can naturally mention their name, role, interests, sources, projects, and competitors all at once - or just share a few things.

### 2. Check for Existing Profile

Look for `00-inbox/MY-PROFILE.md`. If it exists:
```
I found an existing COG profile! What would you like to update? Just tell me what you'd like to change - your interests, projects, profile info, or anything else.
```

**Don't present a numbered menu.** Let them describe what they want in natural language.

### 3. Intelligent Information Extraction

After the user responds, extract as much as possible from their natural language:

| Field | How to Extract |
|-------|---------------|
| **Name** | Look for self-introduction patterns ("I'm Alex", "My name is...", "Call me..."). Use first name by default. |
| **Role** | Look for job/activity mentions ("I'm a PM", "I work in...", "software engineer at..."). |
| **Interests** | Look for topic mentions ("interested in AI", "following crypto", "love design"). Also infer from role context. |
| **News Sources** | Look for source mentions ("I read HN", "follow on Twitter"). If not mentioned, skip - it's optional. |
| **Projects** | Look for project mentions ("working on a SaaS app", "building..."). If not mentioned, skip. |
| **Competitive Watch** | Look for company/person mentions ("tracking Stripe", "watching what OpenAI does"). If not mentioned, skip. |

### 4. Smart Follow-Up (Only If Needed)

After extracting what you can, check what's missing from the **required** fields only:
- **Name** (required)
- **Role** (required)
- **Interests** (required - need at least 2-3 topics)

If any required field is missing, ask ONE follow-up that covers all gaps. For example:
```
Thanks! I got your name and role. What topics are you most interested in staying updated on? (e.g., AI, startups, design, health - whatever matters to you)
```

**Optional fields** (news sources, projects, competitive watch) should NEVER generate follow-up questions. If the user didn't mention them, skip them. They can always add them later by editing the files or running onboarding again.

### 5. Confirm and Create

Before creating files, briefly confirm what you captured and ask about agent team mode:
```
Here's what I've got:

- **Name**: Alex
- **Role**: Product Manager at a fintech startup
- **Interests**: AI/ML, fintech trends, product strategy, UX design
- **Projects**: Payments dashboard revamp
- **Tracking**: Stripe, Plaid

One more thing - COG can run in two modes:
- **Solo mode** (default): I handle everything directly in our conversation.
- **Agent team mode**: I delegate research, analysis, and writing to specialist sub-agents for deeper, more thorough results. Works best with Claude Code.

Which do you prefer? (Solo is great for most people - team mode is for power users who want maximum depth.)
```

**Wait for confirmation**, then generate everything. If they say "looks good" or similar, proceed. If they correct something, update and proceed without re-confirming. Default to `solo` if they don't express a preference.

### 5.5. Role Pack Matching

After extracting the user's role text in Step 3, scan `.claude/roles/*.md` for a matching role pack:

1. Read each role pack file's YAML frontmatter (`role_id` and `aliases`)
2. Compare the user's extracted role text (case-insensitive) against:
   - Exact `role_id` match (e.g., "product-manager")
   - Any string in `aliases` (e.g., "pm", "product lead", "head of product")
   - Fuzzy substring match (e.g., "product manager at a fintech startup" contains "product manager")
3. If a match is found:
   - Store the matched `role_id` as `role_pack` in the MY-PROFILE.md frontmatter
   - Present role-specific recommendations:
   ```
   As a [Role Display Name], here are the skills and integrations that'll be most use

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 6ea1a6f

Download folder ↗
git clone https://github.com/huytieu/COG-second-brain
git -C COG-second-brain checkout 6ea1a6ff2160

The author documents no install command, so this uses the repository directly. Our verdict covers commit 6ea1a6ff2160 only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
Claude CodeMentioned in its text, not testedSkills for Claude Code · About Claude Code
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. ✓SAFE B 89 / 100

    first audit · source 6ea1a6ff2160

README badge

For maintainers · shows the latest audit

ModelsAtlas: SAFE BMODELSATLASSAFE · B
[![ModelsAtlas: SAFE B](https://modelsatlas.com/skills/huytieu/onboarding/badge.svg)](https://modelsatlas.com/skills/huytieu/onboarding/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

Similar skills

Add this badge to your README

[![ModelsAtlas: SAFE B](https://modelsatlas.com/skills/huytieu/onboarding/badge.svg)](https://modelsatlas.com/skills/huytieu/onboarding/)

Questions about Onboarding

What does the Onboarding skill do?
Self-evolving second brain with 35 AI skills, 10 agents, and people CRM. Closed-loop harness: a V-model verification lifecycle where the worker never grades its own homework. Plus paired anti-slop design skills for marketing and product UI. Works with Claude Code, Cursor, Kiro, Gemini CLI, Codex.
Is Onboarding safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can Onboarding access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
Which assistants does Onboarding work with?
Its documentation mentions claude-code. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (6ea1a6ff2160), read on 2026-10-14. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.