Nate Jones Second Brain

• Outcome: Pass
• Latest audit: May 28, 2026 · 12:44 PM UTC
• Version: 1.0.2

Overview

This skill does what it says: it builds a personal knowledge database, but users must be comfortable storing private notes in Supabase and sending captured text to OpenRouter.

Install only for a dedicated personal Supabase project, not a database with unrelated app data. Protect and rotate the Supabase service-role key and OpenRouter key, avoid capturing secrets or highly sensitive third-party communications, and review OpenRouter/model-provider data policies because captured text and search queries are sent out for AI processing.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (19)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document encourages frictionless capture of thoughts from channels like Slack, Signal, SMS, and voice into persistent storage, but it does not warn about collecting sensitive personal, work, or third-party data. In a personal knowledge system, this omission can lead users to ingest private communications or regulated data without informed consent, retention limits, or handling safeguards.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The framework states that OpenRouter is the AI gateway used for classification, but it does not disclose that captured content may be transmitted to an external processor. Because the system is designed to collect broad freeform input, users may unknowingly send confidential, personal, or proprietary text to a third party, creating privacy, compliance, and data exposure risk.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The correction flow instructs the agent to delete records from the wrong table and recreate them elsewhere, but it does not warn about destructive operations, accidental data loss, or the need for rollback. In an agent-mediated workflow, mistaken entity matching or automation errors could silently remove or overwrite user data, undermining integrity and trust.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The ingest flow sends full captured thought text to OpenRouter for embeddings and classification, but the document provides no explicit privacy notice, consent step, or guidance about handling sensitive personal content. Because these thoughts may include private messages, health, relationship, or work information from sources like Signal, SMS, email, and voice, undisclosed third-party transmission creates a real privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to always store the raw thought text, embedding, and extracted metadata in Supabase, again without an explicit storage/retention warning. This is risky because the data model preserves potentially sensitive content and derived metadata indefinitely, increasing exposure in the event of overcollection, misuse, or database compromise.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documented chat completion flow sends raw user thought text to OpenRouter for classification and routing, but the file provides no privacy notice, consent guidance, or data-handling warning. In a personal knowledge system, those thoughts may contain sensitive personal, professional, or confidential material, so silently transmitting them to a third-party AI gateway creates a real privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The embeddings examples transmit user-provided text to an external API for semantic search without warning that the content leaves the local system. Because this skill is explicitly designed as a 'second brain' for capturing arbitrary thoughts, the likely data includes sensitive notes, making undocumented external transmission materially risky.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The document repeatedly instructs users to perform retrieval with the Supabase service-role key, which is a privileged secret that bypasses normal client-side access controls. It also sends user query text to OpenRouter for embeddings without any privacy warning, so sensitive personal knowledge queries may be disclosed to an external provider while privileged database access is normalized in examples.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The schema explicitly stores highly sensitive personal knowledge data, including freeform thoughts, people-related context, follow-ups, action items, dates, and source metadata from channels like Slack and Signal, but the documentation provides no privacy notice, retention guidance, data minimization requirements, or consent boundaries. In a personal knowledge system with semantic search across all records, this increases the risk of over-collection, unauthorized secondary use, and exposure of intimate or third-party personal information if the service role or surrounding application is compromised or misused.

External Transmission

Medium

• Category: Data Exfiltration

Content

Convert the thought text into a 1536-dimensional vector via OpenRouter.

```bash
curl -s -X POST "https://openrouter.ai/api/v1/embeddings" \
  -H "Authorization: Bearer $OPENROUTER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 90% confidence
• Finding: This call transmits user-supplied thought text to an external AI provider. In this skill's context, the content can originate from private channels like Signal, SMS, email, and voice, so the external transmission materially increases confidentiality risk if users are not clearly informed and protected.

External Transmission

Medium

• Category: Data Exfiltration

Content

1. Batch the embedding call (OpenRouter supports array input):

```bash
curl -s -X POST "https://openrouter.ai/api/v1/embeddings" \
  -H "Authorization: Bearer $OPENROUTER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 89% confidence
• Finding: The batch embedding flow sends multiple thoughts in one request to OpenRouter, amplifying the same external-transmission risk and potentially increasing the volume of sensitive content disclosed at once. Batch mode can worsen impact because a single action may expose many private entries without granular user awareness or consent.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Embed the query
QUERY_EMBEDDING=$(curl -s -X POST "https://openrouter.ai/api/v1/embeddings" \
  -H "Authorization: Bearer $OPENROUTER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "openai/text-embedding-3-small", "input": "career changes"}' \

• Confidence: 93% confidence
• Finding: This example transmits raw query text to OpenRouter's embeddings API, which can expose sensitive personal knowledge queries to a third party. In the context of a 'second brain' skill containing people, projects, and admin data, even seemingly short search phrases may reveal confidential relationships, work items, or intentions.

External Transmission

Medium

• Category: Data Exfiltration

Content

| jq -c '.data[0].embedding')

# Search all tables
curl -s -X POST "$SUPABASE_URL/rest/v1/rpc/search_all" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: application/json" \

• Confidence: 98% confidence
• Finding: The example uses the Supabase service-role key directly in client-style curl commands for retrieval, exposing a highly privileged credential pattern that can grant broad read/write or RLS-bypassing access if reused improperly. Because this skill is built around sensitive personal knowledge tables, misuse of this pattern could lead to full compromise of stored notes, people records, tasks, and projects.

External Transmission

Medium

• Category: Data Exfiltration

Content

-d '{"model": "openai/text-embedding-3-small", "input": "website redesign tasks"}' \
  | jq -c '.data[0].embedding')

curl -s -X POST "$SUPABASE_URL/rest/v1/rpc/match_thoughts" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: application/json" \

• Confidence: 97% confidence
• Finding: This retrieval example again uses the service-role key to query the thoughts table through an RPC endpoint, normalizing privileged access for inbox/audit-log data that may contain especially sensitive free-form content. If an operator copies this pattern into a client, an exposed key could provide unrestricted access to highly sensitive captured thoughts and metadata.

External Transmission

Medium

• Category: Data Exfiltration

Content

-d '{"model": "openai/text-embedding-3-small", "input": "career mentors"}' \
  | jq -c '.data[0].embedding')

curl -s -X POST "$SUPABASE_URL/rest/v1/rpc/match_people" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: application/json" \

• Confidence: 96% confidence
• Finding: The match_people example uses the privileged service-role key for retrieval of relationship data, which may include sensitive personal context and follow-ups. Encouraging this pattern increases the chance of secret leakage and unauthorized bulk access to personal relationship records.

External Transmission

Medium

• Category: Data Exfiltration

Content

-d '{"model": "openai/text-embedding-3-small", "input": "website redesign"}' \
  | jq -c '.data[0].embedding')

curl -s -X POST "$SUPABASE_URL/rest/v1/rpc/match_projects" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: application/json" \

• Confidence: 96% confidence
• Finding: The match_projects example performs retrieval with a service-role key, creating a dangerous precedent of privileged direct database access for project data. If adopted as written, leakage of that key could expose project notes, statuses, and next actions across the entire dataset.

External Transmission

Medium

• Category: Data Exfiltration

Content

-d '{"model": "openai/text-embedding-3-small", "input": "AI coaching ideas"}' \
  | jq -c '.data[0].embedding')

curl -s -X POST "$SUPABASE_URL/rest/v1/rpc/match_ideas" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: application/json" \

• Confidence: 96% confidence
• Finding: This example queries ideas data using the service-role key, again modeling direct privileged access to the database. Because idea stores often contain strategic, creative, or business-sensitive material, misuse could result in broad confidentiality loss.

External Transmission

Medium

• Category: Data Exfiltration

Content

-d '{"model": "openai/text-embedding-3-small", "input": "presentation follow-ups"}' \
  | jq -c '.data[0].embedding')

curl -s -X POST "$SUPABASE_URL/rest/v1/rpc/match_admin" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: application/json" \

• Confidence: 97% confidence
• Finding: The admin/task retrieval example uses the service-role key for direct access to administrative records, which may include due dates, notes, and operational follow-ups. In this skill's context, that exposes potentially sensitive planning and operational data and trains users toward an unsafe secret-handling model.

External Transmission

Medium

• Category: Data Exfiltration

Content

| jq -c '.data[0].embedding')

# 2. Insert into Supabase
curl -s -X POST "$SUPABASE_URL/rest/v1/thoughts" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: application/json" \

• Confidence: 83% confidence
• Finding: This example instructs users to perform a write using the Supabase service_role key over the REST API, which grants full database privileges if exposed or reused unsafely. In the context of an agent skill, encouraging routine operational use of a highly privileged key increases the blast radius of compromise and can lead to full read/write access to all stored knowledge data.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.