COG-second-brain
Self-evolving second brain with 35 AI skills, 10 agents, and people CRM. Closed-loop harness: a V-model verification lifecycle where the worker never grades its own homework. Plus paired anti-slop design skills for marketing and product UI. Works with Claude Code, Cursor, Kiro, Gemini CLI, Codex.
No outside reports on file
This skill centralizes work, verification, and people data, so misconfiguration or abuse of its permissions could leak sensitive information or bypass quality checks meant to catch AI errors.
Based on public adoption and transparency signals as of Oct 22, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesNo local folder access notedLOW
- Command executionNo shell command runner notedLOW
- Network reachConnects to outside service APINOTED
- CredentialsNo API token requiredLOW
- Package sourceGitHub (huytieu/COG-second-brain)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
No npm or PyPI package is listed. Install from source: github.com/huytieu/COG-second-brain ↗
Everything known
We found nothing about this project in the sources we read (last checked 2026-10-30). That does not mean it has no problems.
0 incidents · 0 advisories · 0 news articles · 0 community threads · checked 2026-10-30
Popularity grade: C (from public signals such as stars and downloads, not a code review). Graded 2026-10-22.
Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-30.
About COG-second-brain
COG-second-brain is a system designed to help AI workers organize and evolve their work over time. It includes 35 AI skills, 10 agents, and a people management tool, plus a verification process where AI output gets checked by a separate system instead of itself.
Who it’s for
Developers and teams using Claude, Cursor, or other AI coding tools who want to build organized workflows and prevent AI mistakes from going unchecked. It targets people building AI-assisted systems that need quality gates.
Alternatives
- Notion or Obsidian with AI plugins: General-purpose knowledge bases with AI helpers, easier to control.
- OpenAI Assistants API: Official AI agent framework with built-in memory and tool calling.
- LangChain or LlamaIndex agents: Open-source frameworks for building multi-step AI workflows with verification steps.
- Zapier or Make: No-code workflow automation with human approval steps between AI actions.
Setup
Check these steps against the project’s own instructions before running anything.
Follow the project's README at https://github.com/huytieu/COG-second-brain (opens external site) for setup instructions. The repo appears designed to be customized rather than installed as a standard package.
Why this grade
Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 1.3k
- Listing last refreshed
- 2026-10-30
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Risks to watch for
- Prompt injection: If this skill processes user input or web content, attackers could hide instructions in text to make the AI behave unexpectedly.
- Data leakage: A 'second brain' that stores work history could expose past conversations, code, or personal details if accessed without permission.
- False verification claims: The 'V-model' verification process relies on the system working as described; misconfiguration could make it skip actual checks.
- Dependency on external AI: Works with multiple AI platforms (Claude, Gemini, etc.); compromising one connection could affect all workflows.
- CRM access: The people management feature means this skill could access contact lists or relationship data if permissions aren't restricted.
How to lower the risk
Least-privilege permissions
- Only connect to AI services and data sources this skill actually needs.
- Restrict file and folder access to the minimum required directories.
Network isolation
- Run this skill in a separate environment from production systems if possible.
- Log and review all connections it makes to external services.
Monitoring
- Track what data the skill reads and writes each time it runs.
- Alert if it suddenly accesses new files, contacts, or cloud services.
Red flags to watch for
- Verification system approving output without real human review.
- Skill requesting access to password managers, email, or payment systems.
- Unexplained data exports or network traffic to unknown servers.
Questions
How do I install COG-second-brain?
COG-second-brain does not publish a standalone npm or PyPI package. Clone or follow the setup instructions in its source repository at github.com/huytieu/COG-second-brain.
Are there security reports about COG-second-brain?
No reports found for this package in our research (last checked 2026-10-30). COG-second-brain currently holds Grade C (Moderate risk signals) based on public adoption and transparency signals. Key risk areas to watch include prompt injection, data leakage, false verification claims.
Is COG-second-brain actively maintained?
COG-second-brain has 1.3k GitHub stars. Our directory data was last refreshed on 2026-10-30. Check recent commit activity, release tags, and open issues at github.com/huytieu/COG-second-brain before pinning it in production.
What are alternatives to COG-second-brain?
Notable alternatives to COG-second-brain include Notion or Obsidian with AI plugins (General-purpose knowledge bases with AI helpers, easier to control), OpenAI Assistants API (Official AI agent framework with built-in memory and tool calling), LangChain or LlamaIndex agents (Open-source frameworks for building multi-step AI workflows with verification steps), Zapier or Make (No-code workflow automation with human approval steps between AI actions). You can also compare COG-second-brain side by side with other skills in the Related tools section on this page.
README badge and team notes
Maintain or use COG-second-brain? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/huytieu-cog-second-brain)HTML embed:
<a href="https://agentarmorhq.com/skills/huytieu-cog-second-brain"><img src="https://agentarmorhq.com/api/badge/huytieu-cog-second-brain" alt="AgentArmorHQ Risk Grade for COG-second-brain" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "huytieu-cog-second-brain"Share with your security lead
Need sign-off to use COG-second-brain? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: COG-second-brain
- **Listing URL:** https://agentarmorhq.com/skills/huytieu-cog-second-brain
- **Type:** AI agent skill
- **Risk Grade:** Grade C (Moderate risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 1.3k GitHub stars
#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Connects to outside service API
- **Credentials:** No API token required
- **Package source:** GitHub (huytieu/COG-second-brain)
#### Recommended Hardened Setup
- **Source Repo:** https://github.com/huytieu/COG-second-brain
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 22, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- AI agent skill
- Publisher
- huytieu
- Source code
- github.com/huytieu/COG-second-brain
- Est. context load
- ~102 tokens idle · ~450 tokens when active (on-demand skill)
- Popularity
- 1.3k GitHub stars
- Last updated
- 2026-10-30
- Last graded
- 2026-10-22
Community
Discussions for COG-second-brain
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude