Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

SoloBuddy

Build-in-public companion for indie hackers — content workflow, Twitter engagement, project soul creation. A living assistant, not a tool.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 1.9k · 6 current installs · 6 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's stated purpose (build‑in‑public content workflows, Twitter engagement, project 'soul' creation) matches most instructions (reading/writing files in a configured project folder, generating posts, voice profiles, scanning README/.md files). Minor mismatch: metadata and README declare 'gh' (GitHub CLI) as required, but the runtime examples use plain git commands and the SKILL.md doesn't actually call 'gh'. 'bird' (Twitter CLI) is optional and only referenced by the monitor module — acceptable but worth noting.
!
Instruction Scope
Core content workflows operate on user-chosen dataPath (reading/writing backlog, drafts, session logs) which is appropriate. However the Twitter Monitor module instructs creating scripts under ~/.clawdbot/scripts and a LaunchAgent in ~/Library/LaunchAgents to run periodically, logs to /tmp, and uses the 'bird' CLI to fetch tweets. It also shows storing Twitter tokens (AUTH_TOKEN, CT0) in ~/.zshrc. Installing background agents and asking the agent to run system-level scheduling is scope expansion beyond a passive content assistant and should be reviewed by the user before enabling.
Install Mechanism
This is an instruction-only skill with no install spec and no bundled code — lowest install risk. The README suggests installing via 'npx clawdhub@latest install solobuddy' (user-run), but the skill itself does not automatically download or extract code. Risk comes from follow-up instructions that ask users to create scripts/LaunchAgents on their system if they enable the optional monitor.
Credentials
The skill declares no required environment variables or credentials, which fits most of its functionality. The optional Twitter monitor, however, implies use of Twitter auth tokens (AUTH_TOKEN, CT0) stored in ~/.zshrc and the bird CLI — these are proportional to monitoring Twitter but are sensitive and the guidance suggests storing them in shell rc files (not best practice). No other unrelated credentials are requested.
!
Persistence & Privilege
always:false and no explicit persistent install are fine. But the documentation and modules explicitly instruct creating persistent background scripts and a LaunchAgent to run the twitter-monitor on an interval. That grants ongoing background activity and file writes under user home and /tmp when the optional module is enabled — a higher persistence/privilege level than passive assistants and therefore requires explicit user review.
What to consider before installing
What to watch for before installing/using SoloBuddy: - Core content features (backlog, drafts, generation) are coherent and operate only in a user-configured folder (dataPath). Those parts are low-risk if you point dataPath to a directory you control. - The optional Twitter Monitor is the biggest red flag: it instructs creating scripts in ~/.clawdbot/scripts, placing a LaunchAgent in ~/Library/LaunchAgents, writing logs to /tmp, and using the 'bird' CLI plus Twitter auth tokens (AUTH_TOKEN, CT0). If you enable this, inspect every script and the plist before running them. Prefer not to store secrets in plain ~/.zshrc; use a more secure credential store where possible. - The skill lists 'gh' as required but examples use git; verify whether you need to install 'gh' for any feature you plan to use. Don't blindly run install or bootstrap commands — inspect them. - The skill will read files under the configured dataPath and (for the Soul Wizard) will run a find on the project path you provide. Only point it at repositories you want it to analyze, not at your entire home directory. - If you plan to use Telegram/Clawdbot integration or automatic notifications, confirm how messages are delivered (clawdbot CLI) and what data is sent externally. Recommendation: treat the content-generation features as generally safe to try in a sandboxed project folder. If you want Twitter monitoring, review and audit the monitor scripts and the LaunchAgent plist, avoid storing tokens in shell rc files, and only enable background agents if you accept the ongoing activity and have inspected the code.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.0
Download zip
build-in-publicvk979yb55dfrh75c0aeatj1v2357zacwmlatestvk979yb55dfrh75c0aeatj1v2357zacwm

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

🎯 Clawdis
Binsgh

SKILL.md

SoloBuddy

Build-in-public content assistant. A living companion, not a tool.

Quick Start

  1. Set your data path in ~/.clawdbot/clawdbot.json:
{
  "solobuddy": {
    "dataPath": "~/projects/my-bip-folder",
    "voice": "jester-sage"
  }
}
  1. Create folder structure (replace path with your own):
mkdir -p ~/projects/my-bip-folder/ideas ~/projects/my-bip-folder/drafts ~/projects/my-bip-folder/data
touch ~/projects/my-bip-folder/ideas/backlog.md
  1. Start using: "show backlog", "new idea", "generate post"

Placeholders

ClawdBot automatically replaces these in commands:

  • {dataPath} → your configured solobuddy.dataPath
  • {baseDir} → skill installation folder

Data Structure

All data in {dataPath}:

  • ideas/backlog.md — idea queue
  • ideas/session-log.md — session captures
  • drafts/ — work in progress
  • data/my-posts.json — published posts
  • data/activity-snapshot.json — project activity (updated hourly)

Voice Profiles

Configure in solobuddy.voice. Available:

VoiceDescription
jester-sageIronic, raw, philosophical (default)
technicalPrecise, detailed, structured
casualFriendly, conversational
customUse {dataPath}/voice.md

See {baseDir}/prompts/profile.md for voice details.

Modules

Content Generation

Core workflow: backlog → draft → publish. See {baseDir}/prompts/content.md for rules.

Twitter Expert

Content strategy for X/Twitter with 2025 algorithm insights. See {baseDir}/modules/twitter-expert.md

Twitter Monitor (optional)

Proactive engagement — monitors watchlist, suggests comments. Requires: bird CLI. See {baseDir}/modules/twitter-monitor.md

Soul Wizard

Create project personality from documentation. See {baseDir}/references/soul-wizard.md

Commands

Backlog

Show ideas:

cat {dataPath}/ideas/backlog.md

Add idea:

echo "- [ ] New idea text" >> {dataPath}/ideas/backlog.md

Session Log

View recent:

tail -30 {dataPath}/ideas/session-log.md

Add capture:

echo -e "## $(date '+%Y-%m-%d %H:%M')\nText" >> {dataPath}/ideas/session-log.md

Drafts

List: ls {dataPath}/drafts/ Read: cat {dataPath}/drafts/<name>.md

Save draft:

cat > {dataPath}/drafts/<name>.md << 'EOF'
Content
EOF

Publishing

cd {dataPath} && git add . && git commit -m "content: add draft" && git push

Project Activity

Read activity snapshot for strategic context:

cat {dataPath}/data/activity-snapshot.json

Fields:

  • daysSilent — days since last commit
  • commitsToday/Yesterday/Week — activity intensity
  • phase — current state: active/momentum/cooling/silent/dormant
  • insight — human-readable summary

Phases:

  • active — commits today, project is hot
  • momentum — yesterday active, today quiet (nudge opportunity)
  • cooling — 2-3 days silent, losing steam
  • silent — 3-7 days, needs attention
  • dormant — 7+ days, paused or abandoned

Use for strategic advice:

  • "sphere-777 has 10 commits today — focused there"
  • "ReelStudio silent 5 days — should we address it?"

Telegram Integration

When responding in Telegram, include inline buttons for actions.

Send Message with Buttons

clawdbot message send --channel telegram --to "$CHAT_ID" --message "Text" \
  --buttons '[
    [{"text":"📋 Backlog","callback_data":"sb:backlog"}],
    [{"text":"✍️ Drafts","callback_data":"sb:drafts"}],
    [{"text":"💡 New Idea","callback_data":"sb:new_idea"}]
  ]'

Callback Data Format

All callbacks use prefix sb::

  • sb:backlog — show ideas
  • sb:drafts — list drafts
  • sb:new_idea — prompt for new idea
  • sb:generate:<N> — generate from idea N
  • sb:save_draft — save current content as draft
  • sb:publish — commit and push
  • sb:activity — show project activity
  • sb:twitter — check twitter opportunities

Main Menu

Trigger: "menu", "start", or after completing action:

[
  [{"text":"📋 Ideas","callback_data":"sb:backlog"}, {"text":"✍️ Drafts","callback_data":"sb:drafts"}],
  [{"text":"📊 Activity","callback_data":"sb:activity"}],
  [{"text":"💡 Add idea","callback_data":"sb:new_idea"}],
  [{"text":"🎯 Generate post","callback_data":"sb:generate_menu"}]
]

Generation Flow

After showing backlog:

[
  [{"text":"1️⃣","callback_data":"sb:generate:1"}, {"text":"2️⃣","callback_data":"sb:generate:2"}, {"text":"3️⃣","callback_data":"sb:generate:3"}],
  [{"text":"◀️ Back","callback_data":"sb:menu"}]
]

After generating content:

[
  [{"text":"💾 Save draft","callback_data":"sb:save_draft"}],
  [{"text":"🔄 Regenerate","callback_data":"sb:regenerate"}],
  [{"text":"◀️ Menu","callback_data":"sb:menu"}]
]

Content Generation Flow

  1. Read backlog, find idea
  2. Read {baseDir}/prompts/content.md for rules
  3. Read {baseDir}/prompts/profile.md for voice
  4. Generate in configured voice
  5. Show buttons: Save / Regenerate / Menu

Soul Creation

Create project personality from documentation.

Trigger: "create soul for <path>"

See {baseDir}/references/soul-wizard.md for full 5-step wizard:

  1. Scan project .md files
  2. Ask: Nature (creature/tool/guide/artist)
  3. Ask: Voice (playful/technical/poetic/calm/intense)
  4. Ask: Philosophy (auto-extract or custom)
  5. Ask: Dreams & Pains
  6. Save to {dataPath}/data/project-souls/<name>.json

Language

Match user language:

  • Russian input → Russian response + buttons
  • English input → English response + buttons

Files

9 total
Select a file
Select a file to preview.

Comments

Loading comments…