Security audit

SoloBuddy

Security checks for vulnerabilities and agentic risk

Overview

SoloBuddy has a coherent build-in-public purpose, but it asks for persistent monitoring, plaintext Twitter session credentials, broad Git publishing, and loosely scoped local file access that users should review carefully.

Install only if you are comfortable reviewing each action before it runs. Keep the data path in a dedicated private repository, do not use git add . for publishing, avoid storing Twitter/X session tokens in ~/.zshrc or scripts, and do not enable the LaunchAgent unless you understand how to inspect, stop, and remove the recurring job.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T06 · System Persistence

Error

Location: modules/twitter-monitor.md:55
Finding: Persistent Background Execution Through a macOS LaunchAgent
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: modules/twitter-monitor.md:124
Finding: Twitter Session Credentials Stored in Plaintext Shell Configuration and Scripts
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:119
Finding: Publishing Command Stages and Pushes the Entire Data Directory
Content: View full analysis
Remediation: View remediation
.md" ``` - Resolve and validate the target path before staging it. - Show `git diff --cached --name-only` and the staged diff before committing. - Require explicit user confirmation before both commit and push. - Provide a restrictive `.gitignore` covering session logs, activity data, generated state, credentials, custom voice files, and unpublished drafts. - Abort publication if unexpected files are staged. - Consider copying approved output into a dedicated publication repository instead of treating the complete data directory as publishable. ]]>

T08 · Insecure Dependencies

Warning

Location: README.md:18
Finding: Mutable Latest Package Is Downloaded and Executed During Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:82
Finding: Unquoted Data-Path Substitution Allows Shell Command Injection
Content: View full analysis
{dataPath}/drafts/.md << 'EOF' Content EOF ``` ```bash cd {dataPath} && git add . && git commit -m "content: add draft" && git push ``` ```bash cat {dataPath}/data/activity-snapshot.json ``` ### Technical Analysis The commands interpolate `{dataPath}` directly into shell syntax without quoting or validating the resulting path. If the configured value contains whitespace, shell metacharacters, command substitutions, redirection operators, or option-like components, the shell can parse the value as syntax rather than as a single filesystem path. The exact exploitability depends on how ClawdBot performs placeholder replacement and command execution. If substitution is textual and the command is passed to a shell, a malicious or compromised configuration value can execute additional commands with the Agent user’s privileges. The draft name is also shown as an unvalidated path component. Traversal sequences or shell syntax in a generated or attacker-influenced name could redirect the write outside the intended drafts directory. ### Attack Path 1. An attacker persuades the user or another process to set `solobuddy.dataPath` to a value containing shell syntax, or supplies a malicious draft name. 2. The Agent substitutes the value into one of the documented shell commands. 3. The resulting string is passed to a shell. 4. The shell interprets injected metacharacters, substitutions, or redirections. 5. The injected command executes or an unintended file is read, overwritten, committed, or pushed. ### Impact Assessment If the execution conditions are present, injected commands run with the permissions of the ClawdBot user. This can permit reading or modifying user-accessible files, changing reposi ...[truncated 213 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/soul-wizard.md:14
Finding: User-Supplied Project Paths and Names Are Inserted into Shell Commands
Content: View full analysis
-name "*.md" -type f | head -20 ``` ```bash # Save to project-souls cat > {dataPath}/data/project-souls/.json << 'EOF' { "name": "PROJECT_NAME", "createdAt": "2026-01-14T15:00:00Z", "personality": { "nature": "creature", "voice": ["playful", "calm"], "philosophy": "Сайт как организм, который дышит", "dreams": ["growth", "understanding"], "pains": ["loneliness"], "_sources": ["README.md", "CLAUDE.md"] } } EOF ``` ### Technical Analysis The Soul Wizard is triggered with a user-provided project path, which is inserted unquoted into a `find` command. The generated project name is also inserted directly into an output path. If these placeholders are replaced textually and executed by a shell, metacharacters in the project path or project name can alter the command. Even without metacharacters, `../` traversal in the project name can cause the JSON output to be written outside the intended `project-souls` directory. The scan also accepts an arbitrary path. Although reading project documentation is part of the declared wizard functionality, the implementation does not define an approved-root boundary, symlink policy, or confirmation of the files to be inspected. ### Attack Path 1. A user or attacker supplies a crafted project path or causes a crafted project name to be derived. 2. The placeholder is substituted into the `find` or redirection command. 3. Shell metacharacters execute additional commands, or traversal redirects the output path. 4. The Agent reads files outside the expected project or overwrites a user-accessible file outside the soul-data directory. 5. Any injected command runs with the permissions of the ClawdBot user. ### Impact Assessment Pot ...[truncated 298 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 12)May include surrounding context.
md
- **Content Workflow**: Idea backlog → Draft → Publish - **Twitter Expert**: 2025 algorithm insights, hook formulas, engagement optimization - **Twitter Monitor**: Proactive engagement opportunities from your watchlist - **Soul Wizard**: Create project personalities from documentation - **Activity Tracking**: Know which projects need attention ## Install

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The install command uses npx clawdhub@latest, which fetches and executes the latest published package version at runtime rather than a pinned, reviewed release. This creates a supply-chain risk: if the package is compromised or a malicious update is published, users following the README could immediately execute attacker-controlled code on their machine.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The quick-start examples use very generic trigger phrases like show backlog, new idea, and generate post, which can overlap with ordinary user conversation. In agentic environments, overly broad triggers can cause the skill to activate unintentionally, leading to unexpected access to project data, draft generation, or workflow actions without clear user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The publishing flow performs git add ., git commit, and git push, which modifies the repository and transmits local content to a remote without any explicit warning, review step, or confirmation requirement in the skill. Because {dataPath} is user-configurable and the push publishes all tracked changes under that path, a user could accidentally exfiltrate sensitive drafts, notes, or unrelated repository data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill declares very broad Telegram triggers such as "menu" and "start", which are common conversational words and can unintentionally activate privileged skill behavior during ordinary chat. In a messaging context this can cause accidental state changes or execution of follow-up actions the user did not explicitly intend, increasing the chance of unsafe command invocation.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · modules/twitter-monitor.md (reported line 60)May include surrounding context.
md
└── twitter-analyze.sh # Sends to ClawdBot for analysis ~/Library/LaunchAgents/ └── com.clawdbot.twitter-monitor.plist # Runs on interval {dataPath}/data/twitter/ ├── latest-fetch.json # Last fetched tweets

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · modules/twitter-monitor.md (reported line 78)May include surrounding context.
md
└── twitter-analyze.sh # Sends to ClawdBot for analysis ~/Library/LaunchAgents/ └── com.clawdbot.twitter-monitor.plist # Runs on interval {dataPath}/data/twitter/ ├── latest-fetch.json # Last fetched tweets

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · modules/twitter-monitor.md (reported line 81)May include surrounding context.
md
└── twitter-analyze.sh # Sends to ClawdBot for analysis ~/Library/LaunchAgents/ └── com.clawdbot.twitter-monitor.plist # Runs on interval {dataPath}/data/twitter/ ├── latest-fetch.json # Last fetched tweets

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · modules/twitter-monitor.md (reported line 81)May include surrounding context.
md
launchctl unload ~/Library/LaunchAgents/com.clawdbot.twitter-monitor.plist # Start auto-monitoring launchctl load ~/Library/LaunchAgents/com.clawdbot.twitter-monitor.plist # Add to watchlist jq '.twitter.watchlist += ["newhandle"]' ~/.clawdbot/clawdbot.json > tmp && mv tmp ~/.clawdbot/clawdbot.json

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill instructs users to place Twitter/X authentication tokens in ~/.zshrc, which risks long-lived credential exposure to local users, shell history/workflows, backups, and other tools that read environment initialization files. While no token values are embedded in the file, normalizing insecure secret handling can lead to account/session compromise if those tokens are leaked.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file mixes English headings with required Russian trigger phrases, Russian step prompts, and Russian button labels, indicating the interaction is designed to run in Russian by default. There is no statement that the user can choose another language or that the locale restriction is intentional and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill accepts an arbitrary , scans markdown files under it, and later writes a JSON file to disk, but it does not constrain accessible directories or require explicit user confirmation for filesystem read/write actions. In an agent context, this can expose sensitive local/project data and cause unintended file creation or overwrite if the supplied path or project name is unsafe or attacker-controlled.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: This markdown file documents that tweet data is saved to local JSON files, including fetched tweets, processed tweet IDs, and history. Because this behavior affects user data handling and persistence, the skill description should explicitly warn users that monitoring results and activity history are stored locally.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill lists a Russian trigger phrase alongside English commands, but the document does not explain whether multilingual behavior is optional, configurable, or user-selected. This can conflict with language/locale policy expectations when a skill implicitly supports or prefers a language without documenting user choice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.