Agent skill · Audited from source
Onboarding
skill · huytieu/COG-second-brainMIT licenceAudited 14 Oct 2026 · source 6ea1a6ff2160
Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 6ea1a6ff2160 and found no filesystem, network or shell access and no hard-coded secrets. What it does: Personalize COG for your workflow - creates profile, interests, and watchlist files with guided setup (run this first!)
Cite
Cite this page
ModelsAtlas. “Onboarding (huytieu/COG-second-brain)”. Retrieved 14 Oct 2026. https://modelsatlas.com/skills/huytieu/onboarding
2 skills are called “Onboarding”. You are viewing huytieu/COG-second-brain.
- huytieu/COG-second-brain★ 1.3k✓SAFE
- BuilderIO/agent-native★ 7.2k!CAUTION
Trust audit
Audit 0.4.1 · source read 14 Oct 2026
SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 13,985 of 14,816 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 0 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | NA | 0 |
L2 Instructions | Prompt injection, authority framing, hidden directives | PASS | 0 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (0)
No findings at any severity. We re-audit when the source changes.
Audit 0.4.1 · source sha 6ea1a6ff2160 · 14 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publisherhuytieu GitHub userOwner of the repository this skill is read from
- Source folderhuytieu/COG-second-brain/.claude/skills/onboardingThe exact folder we audited
- LicenceMITAs the repository states it
- Commit pinned for this verdict6ea1a6ff2160A new audit runs when the source changes
- Repository statusNot archivedLast push 11 days ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Personalize COG for your workflow - creates profile, interests, and watchlist files with guided setup (run this first!)
---
name: onboarding
description: Personalize COG for your workflow - creates profile, interests, and watchlist files with guided setup (run this first!)
roles: [all]
integrations: []
---
# COG Onboarding Skill
## Purpose
Welcome new users and collect essential information to personalize their COG experience. All configuration is stored as natural markdown files within the vault structure, following COG's philosophy of transparent, editable knowledge.
## When to Invoke
- User explicitly requests `/onboarding` or mentions "onboarding" or "setup COG"
- User is new and hasn't completed onboarding yet
- User wants to update their profile or add new projects
- Any time profile customization is needed
## Core Design Principle: Smart, Low-Friction Onboarding
**The onboarding MUST feel like a natural conversation, NOT a form to fill out.**
Key rules:
- **Ask open-ended questions, not option-pickers.** Never present numbered lists of choices for the user to pick from.
- **Ask as few questions as possible.** Infer what you can from context and the user's natural responses.
- **Never ask redundant questions.** If you can extract the answer from something the user already said, don't ask again.
- **Parse intelligently.** If someone says "I'm Alex, a PM at a fintech startup tracking Stripe and Plaid", extract: name=Alex, role=PM at fintech startup, watchlist=[Stripe, Plaid]. Don't ask follow-up questions for info already given.
- **Confirm, don't re-ask.** If you're unsure about something the user said, confirm your interpretation rather than asking the question fresh.
## Process Flow
### 1. Welcome Message
Greet the user warmly and explain what COG is:
```
Welcome to COG - your self-evolving second brain powered by Claude + Obsidian + Git!
COG helps you capture thoughts, get daily intelligence briefings, and build knowledge over time - all stored as simple markdown files you own.
Let's get you set up. Tell me a bit about yourself - your name, what you do, and what topics or areas you're most interested in staying sharp on. Feel free to share as much or as little as you'd like.
```
**This single open-ended prompt replaces the old sequential questions.** The user can naturally mention their name, role, interests, sources, projects, and competitors all at once - or just share a few things.
### 2. Check for Existing Profile
Look for `00-inbox/MY-PROFILE.md`. If it exists:
```
I found an existing COG profile! What would you like to update? Just tell me what you'd like to change - your interests, projects, profile info, or anything else.
```
**Don't present a numbered menu.** Let them describe what they want in natural language.
### 3. Intelligent Information Extraction
After the user responds, extract as much as possible from their natural language:
| Field | How to Extract |
|-------|---------------|
| **Name** | Look for self-introduction patterns ("I'm Alex", "My name is...", "Call me..."). Use first name by default. |
| **Role** | Look for job/activity mentions ("I'm a PM", "I work in...", "software engineer at..."). |
| **Interests** | Look for topic mentions ("interested in AI", "following crypto", "love design"). Also infer from role context. |
| **News Sources** | Look for source mentions ("I read HN", "follow on Twitter"). If not mentioned, skip - it's optional. |
| **Projects** | Look for project mentions ("working on a SaaS app", "building..."). If not mentioned, skip. |
| **Competitive Watch** | Look for company/person mentions ("tracking Stripe", "watching what OpenAI does"). If not mentioned, skip. |
### 4. Smart Follow-Up (Only If Needed)
After extracting what you can, check what's missing from the **required** fields only:
- **Name** (required)
- **Role** (required)
- **Interests** (required - need at least 2-3 topics)
If any required field is missing, ask ONE follow-up that covers all gaps. For example:
```
Thanks! I got your name and role. What topics are you most interested in staying updated on? (e.g., AI, startups, design, health - whatever matters to you)
```
**Optional fields** (news sources, projects, competitive watch) should NEVER generate follow-up questions. If the user didn't mention them, skip them. They can always add them later by editing the files or running onboarding again.
### 5. Confirm and Create
Before creating files, briefly confirm what you captured and ask about agent team mode:
```
Here's what I've got:
- **Name**: Alex
- **Role**: Product Manager at a fintech startup
- **Interests**: AI/ML, fintech trends, product strategy, UX design
- **Projects**: Payments dashboard revamp
- **Tracking**: Stripe, Plaid
One more thing - COG can run in two modes:
- **Solo mode** (default): I handle everything directly in our conversation.
- **Agent team mode**: I delegate research, analysis, and writing to specialist sub-agents for deeper, more thorough results. Works best with Claude Code.
Which do you prefer? (Solo is great for most people - team mode is for power users who want maximum depth.)
```
**Wait for confirmation**, then generate everything. If they say "looks good" or similar, proceed. If they correct something, update and proceed without re-confirming. Default to `solo` if they don't express a preference.
### 5.5. Role Pack Matching
After extracting the user's role text in Step 3, scan `.claude/roles/*.md` for a matching role pack:
1. Read each role pack file's YAML frontmatter (`role_id` and `aliases`)
2. Compare the user's extracted role text (case-insensitive) against:
- Exact `role_id` match (e.g., "product-manager")
- Any string in `aliases` (e.g., "pm", "product lead", "head of product")
- Fuzzy substring match (e.g., "product manager at a fintech startup" contains "product manager")
3. If a match is found:
- Store the matched `role_id` as `role_pack` in the MY-PROFILE.md frontmatter
- Present role-specific recommendations:
```
As a [Role Display Name], here are the skills and integrations that'll be most useExcerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 6ea1a6f
git clone https://github.com/huytieu/COG-second-brain git -C COG-second-brain checkout 6ea1a6ff2160
The author documents no install command, so this uses the repository directly. Our verdict covers commit 6ea1a6ff2160 only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| Claude Code | Mentioned in its text, not tested | Skills for Claude Code · About Claude Code |
Audit history
Every audit, every source change
- ✓SAFE B 89 / 100
first audit · source
6ea1a6ff2160
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/huytieu/onboarding/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
huytieu/COG-second-brain
Deep strategic research engine — decomposes questions into parallel research threads, spawns multiple agents, and synthesizes into actionable strategic analysis
huytieu/COG-second-brain
Quick capture of raw thoughts with intelligent domain classification and competitive intelligence extraction
huytieu/COG-second-brain
Deep-dive 7-day analysis across all data sources for weekly reviews, board prep, and strategic planning
huytieu/COG-second-brain
Create user stories with duplicate checking across any project tracker (Linear, GitHub Issues, Jira)
huytieu/COG-second-brain
Generate personalized news intelligence with verified sources (7-day freshness requirement)
huytieu/COG-second-brain
Audit and export open issues from any project tracker with summary analysis and vault archival
Add this badge to your README
[](https://modelsatlas.com/skills/huytieu/onboarding/)
<a href="https://modelsatlas.com/skills/huytieu/onboarding/"><img src="https://modelsatlas.com/skills/huytieu/onboarding/badge.svg" alt="ModelsAtlas: SAFE B"></a>
Questions about Onboarding
What does the Onboarding skill do?
Is Onboarding safe to install?
What can Onboarding access on my machine?
Which assistants does Onboarding work with?
How current is this page?
Sources
- github.com/huytieu/COG-second-brain/tree/main/.claude/skills/onb — the audited source at commit 6ea1a6ff2160 and every finding aboveObserved · 14 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the Onboarding skill do?
- Is Onboarding safe to install?
- What can Onboarding access on my machine?