SoloBuddy

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:50 AM UTC
• Version: 1.0.0

Overview

SoloBuddy has a coherent build-in-public purpose, but it asks for persistent monitoring, plaintext Twitter session credentials, broad Git publishing, and loosely scoped local file access that users should review carefully.

Install only if you are comfortable reviewing each action before it runs. Keep the data path in a dedicated private repository, do not use git add . for publishing, avoid storing Twitter/X session tokens in ~/.zshrc or scripts, and do not enable the LaunchAgent unless you understand how to inspect, stop, and remove the recurring job.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T06 · System Persistence

Error

• Location: modules/twitter-monitor.md:55
• Finding: Persistent Background Execution Through a macOS LaunchAgent<![CDATA[ ## Vulnerability Details **File Location**: `modules/twitter-monitor.md`, lines 55-61 and 76-81 **Vulnerability Type**: Cross-session scheduled execution **Risk Level**: High ### Vulnerable Code ```text ~/.clawdbot/scripts/ ├── twitter-monitor.sh # Fetches tweets via bird CLI └── twitter-analyze.sh # Sends to ClawdBot for analysis ~/Library/LaunchAgents/ └── com.clawdbot.twitter-monitor.plist # Runs on interval ``` ```bash # Stop auto-monitoring launchctl unload ~/Library/LaunchAgents/com.clawdbot.twitter-monitor.plist # Start auto-monitoring launchctl load ~/Library/LaunchAgents/com.clawdbot.twitter-monitor.plist ``` ### Technical Analysis The module instructs users to load a per-user macOS LaunchAgent. Once loaded, the service can execute across login sessions at the configured interval. Scheduled monitoring is related to the optional Twitter-monitoring feature, but it exceeds the privileges required for manual monitoring and introduces a persistent execution mechanism. The referenced plist and shell scripts are not included in the audited package. Consequently, their program arguments, filesystem permissions, network behavior, and integrity protections cannot be verified. Loading a plist from a user-writable location also means that subsequent modification of either the plist or its target scripts can change what is executed persistently. ### Attack Path 1. The user creates or obtains the referenced plist and monitoring scripts. 2. The user follows the documented `launchctl load` command. 3. The LaunchAgent begins executing the configured script at recurring intervals. 4. Another process, compromised update, or attacker with write access modifies the user-owned plist or scripts. 5. The altered code executes automatically under the user account during later scheduled runs or login sessions. ### Impact Assessment The mechanism does not inherently grant root privileges, but it provides recurring code execution with the full permiss ...[truncated 309 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Make manual, on-demand monitoring the default. - Require explicit informed consent before creating or loading any LaunchAgent. - Include the exact plist and scripts in the reviewed package rather than referring to unavailable files. - Display the complete plist and executable paths before activation. - Use absolute, canonical paths and validate ownership and permissions before every load. - Restrict plist and script permissions so they are writable only by the user. - Add integrity verification for the persistent scripts. - Provide a complete removal procedure that unloads the agent and deletes the plist, scripts, logs, and generated state. - Allow the user to configure a finite runtime or expiration rather than enabling indefinite monitoring. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: modules/twitter-monitor.md:124
• Finding: Twitter Session Credentials Stored in Plaintext Shell Configuration and Scripts<![CDATA[ ## Vulnerability Details **File Location**: `modules/twitter-monitor.md`, lines 124-138 **Vulnerability Type**: Insecure credential storage **Risk Level**: High ### Vulnerable Code ```bash Credentials in `~/.zshrc`: ```bash export AUTH_TOKEN="..." export CT0="..." ``` ``` ```text bird: credentials not found: → Re-login to x.com in browser → Update AUTH_TOKEN/CT0 in ~/.zshrc and scripts ``` ### Technical Analysis `AUTH_TOKEN` and `CT0` are sensitive X/Twitter session values. The instructions recommend storing them in plaintext in `~/.zshrc` and potentially copying them into monitoring scripts. Secrets exported from a shell startup file are inherited by child processes launched from that shell. Duplicating the values in executable scripts further increases their exposure to local processes, backups, diagnostic archives, accidental repository commits, and overly broad filesystem permissions. Although the monitor necessarily communicates with X through the `bird` CLI, the available files do not establish that these credentials are intentionally exfiltrated to an unrelated endpoint. The confirmed issue is insecure local storage and propagation. ### Attack Path 1. The user extracts the Twitter session values from a browser session. 2. The user places the values in `~/.zshrc` or the monitor scripts as instructed. 3. A local process, malicious dependency, backup system, support archive, or accidentally committed repository reads the plaintext values. 4. An attacker obtains the tokens and attempts to reuse the authenticated session against X. 5. The attacker performs actions allowed by the stolen session until the credentials expire or are revoked. ### Impact Assessment Successful theft may expose the associated X account to unauthorized authenticated access. Depending on the session permissions and platform controls, this could permit reading account data, collecting private information, or performing account actions. The issue affects the privilege ...[truncated 64 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Store session credentials in the macOS Keychain or another dedicated secret manager. - Retrieve secrets only when needed and avoid globally exporting them through shell startup files. - Never embed credentials directly in executable scripts. - Apply restrictive permissions such as mode `0600` to any unavoidable credential file. - Prevent secrets from appearing in process arguments, logs, crash reports, or diagnostics. - Add credential files and generated scripts to `.gitignore`. - Document how to revoke active X sessions immediately after suspected disclosure. - Prefer scoped, revocable API credentials over browser session cookies where supported. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:119
• Finding: Publishing Command Stages and Pushes the Entire Data Directory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 119 **Vulnerability Type**: Excessive data staging and unintended network disclosure **Risk Level**: High ### Vulnerable Code ```bash cd {dataPath} && git add . && git commit -m "content: add draft" && git push ``` ### Technical Analysis The documented publishing operation runs `git add .`, which stages every unignored change beneath the configured data directory rather than only the draft selected for publication. The same Skill documents this directory as containing idea backlogs, session logs, unpublished drafts, activity snapshots, custom voice data, published-post history, and project-soul records. If these files are tracked or not excluded, `git push` transmits them to the configured Git remote along with the intended content. This behavior exceeds the minimum access required to publish a single draft. ### Attack Path 1. Private notes, logs, metadata, or unpublished content accumulate beneath `{dataPath}`. 2. The user requests publication of one draft. 3. The documented command executes `git add .`. 4. All unignored changes under the directory are included in the commit. 5. `git push` sends the commit to the repository’s configured remote. 6. Sensitive data becomes accessible to repository administrators, collaborators, or the public if the repository is public. ### Impact Assessment The command can disclose any unignored file within the repository working tree. Potentially exposed information includes private ideas, development activity, unpublished posts, custom writing profiles, session captures, and project-derived documentation summaries. It does not provide operating-system privilege escalation, but it can cause durable remote disclosure through Git history. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Stage only the explicitly selected draft, for example: ```bash git add -- "drafts/<validated-name>.md" ``` - Resolve and validate the target path before staging it. - Show `git diff --cached --name-only` and the staged diff before committing. - Require explicit user confirmation before both commit and push. - Provide a restrictive `.gitignore` covering session logs, activity data, generated state, credentials, custom voice files, and unpublished drafts. - Abort publication if unexpected files are staged. - Consider copying approved output into a dedicated publication repository instead of treating the complete data directory as publishable. ]]>

T08 · Insecure Dependencies

Warning

• Location: README.md:18
• Finding: Mutable Latest Package Is Downloaded and Executed During Installation<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, line 18 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```bash npx clawdhub@latest install solobuddy ``` ### Technical Analysis The installation command uses `npx` with the mutable `latest` tag. This downloads and executes whatever package version the registry resolves at installation time. The effective installer can therefore change after the Skill has been reviewed. The audited project does not demonstrate that the package is currently malicious. The security issue is that the command creates a supply-chain execution channel whose future payload is not version-pinned or integrity-verified. ### Attack Path 1. A user follows the installation command. 2. The package registry resolves `clawdhub@latest`. 3. An upstream account compromise, malicious release, or dependency compromise changes the resolved package. 4. `npx` downloads and executes the changed package. 5. Package CLI or lifecycle code runs with the permissions of the installing user. ### Impact Assessment A compromised installer can perform any operation available to the user running `npx`, including reading user-accessible files, modifying configuration, accessing environment variables, installing persistence, or making network requests. No root access is implied unless the user separately elevates the command. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the installer to a specific audited version rather than `latest`. - Publish and verify a cryptographic integrity hash or signed release. - Document the expected package publisher and provenance. - Disable or audit package lifecycle scripts where feasible. - Review dependency-lock information for the installer. - Require a separate, explicit update process so future package changes are not silently executed. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:82
• Finding: Unquoted Data-Path Substitution Allows Shell Command Injection<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 82-126 **Vulnerability Type**: Shell injection through unquoted configuration placeholders **Risk Level**: High ### Vulnerable Code ```bash cat {dataPath}/ideas/backlog.md ``` ```bash cat > {dataPath}/drafts/<name>.md << 'EOF' Content EOF ``` ```bash cd {dataPath} && git add . && git commit -m "content: add draft" && git push ``` ```bash cat {dataPath}/data/activity-snapshot.json ``` ### Technical Analysis The commands interpolate `{dataPath}` directly into shell syntax without quoting or validating the resulting path. If the configured value contains whitespace, shell metacharacters, command substitutions, redirection operators, or option-like components, the shell can parse the value as syntax rather than as a single filesystem path. The exact exploitability depends on how ClawdBot performs placeholder replacement and command execution. If substitution is textual and the command is passed to a shell, a malicious or compromised configuration value can execute additional commands with the Agent user’s privileges. The draft name is also shown as an unvalidated path component. Traversal sequences or shell syntax in a generated or attacker-influenced name could redirect the write outside the intended drafts directory. ### Attack Path 1. An attacker persuades the user or another process to set `solobuddy.dataPath` to a value containing shell syntax, or supplies a malicious draft name. 2. The Agent substitutes the value into one of the documented shell commands. 3. The resulting string is passed to a shell. 4. The shell interprets injected metacharacters, substitutions, or redirections. 5. The injected command executes or an unintended file is read, overwritten, committed, or pushed. ### Impact Assessment If the execution conditions are present, injected commands run with the permissions of the ClawdBot user. This can permit reading or modifying user-accessible files, changing reposi ...[truncated 213 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Avoid constructing shell command strings from placeholders. - Invoke commands through argument arrays or structured tool APIs. - If shell use is unavoidable, safely quote every expansion: ```bash cat -- "${dataPath}/ideas/backlog.md" cd -- "${dataPath}" ``` - Canonicalize the configured path and verify that it is an approved directory. - Reject control characters, shell metacharacters, traversal components, and unexpected path schemes. - Restrict draft names to a conservative allowlist such as letters, digits, hyphens, and underscores. - Verify that every write target remains beneath the canonical drafts directory. - Separate commit and push operations and request confirmation for each sensitive action. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/soul-wizard.md:14
• Finding: User-Supplied Project Paths and Names Are Inserted into Shell Commands<![CDATA[ ## Vulnerability Details **File Location**: `references/soul-wizard.md`, lines 14-15 and 131-143 **Vulnerability Type**: Shell injection and path traversal **Risk Level**: High ### Vulnerable Code ```bash # Find all .md files in project find <path> -name "*.md" -type f | head -20 ``` ```bash # Save to project-souls cat > {dataPath}/data/project-souls/<project-name>.json << 'EOF' { "name": "PROJECT_NAME", "createdAt": "2026-01-14T15:00:00Z", "personality": { "nature": "creature", "voice": ["playful", "calm"], "philosophy": "Сайт как организм, который дышит", "dreams": ["growth", "understanding"], "pains": ["loneliness"], "_sources": ["README.md", "CLAUDE.md"] } } EOF ``` ### Technical Analysis The Soul Wizard is triggered with a user-provided project path, which is inserted unquoted into a `find` command. The generated project name is also inserted directly into an output path. If these placeholders are replaced textually and executed by a shell, metacharacters in the project path or project name can alter the command. Even without metacharacters, `../` traversal in the project name can cause the JSON output to be written outside the intended `project-souls` directory. The scan also accepts an arbitrary path. Although reading project documentation is part of the declared wizard functionality, the implementation does not define an approved-root boundary, symlink policy, or confirmation of the files to be inspected. ### Attack Path 1. A user or attacker supplies a crafted project path or causes a crafted project name to be derived. 2. The placeholder is substituted into the `find` or redirection command. 3. Shell metacharacters execute additional commands, or traversal redirects the output path. 4. The Agent reads files outside the expected project or overwrites a user-accessible file outside the soul-data directory. 5. Any injected command runs with the permissions of the ClawdBot user. ### Impact Assessment Pot ...[truncated 298 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pass the project path to `find` as a separately quoted argument: ```bash find -- "$project_path" -name '*.md' -type f ``` - Prefer a filesystem API instead of a shell pipeline. - Canonicalize the project path and require it to remain beneath a user-approved root. - Define and enforce a symlink-following policy. - Present the discovered file list and obtain confirmation before reading contents. - Derive output filenames through a strict allowlist and reject `.` and `..` components. - Canonicalize the output path and verify containment beneath `{dataPath}/data/project-souls`. - Create files with restrictive permissions and refuse to overwrite existing files without confirmation. - Serialize JSON through a JSON library rather than constructing it through a shell heredoc. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Session Persistence

Medium

• Category: Rogue Agent

Content

- **Content Workflow**: Idea backlog → Draft → Publish
- **Twitter Expert**: 2025 algorithm insights, hook formulas, engagement optimization
- **Twitter Monitor**: Proactive engagement opportunities from your watchlist
- **Soul Wizard**: Create project personalities from documentation
- **Activity Tracking**: Know which projects need attention

## Install

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The install command uses `npx clawdhub@latest`, which fetches and executes the latest published package version at runtime rather than a pinned, reviewed release. This creates a supply-chain risk: if the package is compromised or a malicious update is published, users following the README could immediately execute attacker-controlled code on their machine.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The quick-start examples use very generic trigger phrases like `show backlog`, `new idea`, and `generate post`, which can overlap with ordinary user conversation. In agentic environments, overly broad triggers can cause the skill to activate unintentionally, leading to unexpected access to project data, draft generation, or workflow actions without clear user intent.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The publishing flow performs `git add .`, `git commit`, and `git push`, which modifies the repository and transmits local content to a remote without any explicit warning, review step, or confirmation requirement in the skill. Because `{dataPath}` is user-configurable and the push publishes all tracked changes under that path, a user could accidentally exfiltrate sensitive drafts, notes, or unrelated repository data.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The skill declares very broad Telegram triggers such as "menu" and "start", which are common conversational words and can unintentionally activate privileged skill behavior during ordinary chat. In a messaging context this can cause accidental state changes or execution of follow-up actions the user did not explicitly intend, increasing the chance of unsafe command invocation.

Session Persistence

Medium

• Category: Rogue Agent

Content

└── twitter-analyze.sh     # Sends to ClawdBot for analysis

~/Library/LaunchAgents/
└── com.clawdbot.twitter-monitor.plist  # Runs on interval

{dataPath}/data/twitter/
├── latest-fetch.json      # Last fetched tweets

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

└── twitter-analyze.sh     # Sends to ClawdBot for analysis

~/Library/LaunchAgents/
└── com.clawdbot.twitter-monitor.plist  # Runs on interval

{dataPath}/data/twitter/
├── latest-fetch.json      # Last fetched tweets

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

└── twitter-analyze.sh     # Sends to ClawdBot for analysis

~/Library/LaunchAgents/
└── com.clawdbot.twitter-monitor.plist  # Runs on interval

{dataPath}/data/twitter/
├── latest-fetch.json      # Last fetched tweets

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

launchctl unload ~/Library/LaunchAgents/com.clawdbot.twitter-monitor.plist

# Start auto-monitoring
launchctl load ~/Library/LaunchAgents/com.clawdbot.twitter-monitor.plist

# Add to watchlist
jq '.twitter.watchlist += ["newhandle"]' ~/.clawdbot/clawdbot.json > tmp && mv tmp ~/.clawdbot/clawdbot.json

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill instructs users to place Twitter/X authentication tokens in ~/.zshrc, which risks long-lived credential exposure to local users, shell history/workflows, backups, and other tools that read environment initialization files. While no token values are embedded in the file, normalizing insecure secret handling can lead to account/session compromise if those tokens are leaked.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file mixes English headings with required Russian trigger phrases, Russian step prompts, and Russian button labels, indicating the interaction is designed to run in Russian by default. There is no statement that the user can choose another language or that the locale restriction is intentional and justified.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill accepts an arbitrary <path>, scans markdown files under it, and later writes a JSON file to disk, but it does not constrain accessible directories or require explicit user confirmation for filesystem read/write actions. In an agent context, this can expose sensitive local/project data and cause unintended file creation or overwrite if the supplied path or project name is unsafe or attacker-controlled.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: This markdown file documents that tweet data is saved to local JSON files, including fetched tweets, processed tweet IDs, and history. Because this behavior affects user data handling and persistence, the skill description should explicitly warn users that monitoring results and activity history are stored locally.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The skill lists a Russian trigger phrase alongside English commands, but the document does not explain whether multilingual behavior is optional, configurable, or user-selected. This can conflict with language/locale policy expectations when a skill implicitly supports or prefers a language without documenting user choice.

Static analysis

No suspicious patterns detected.