Social Reply Bot

Reddit & X/Twitter auto-reply bot for ecommerce/SaaS growth. Finds relevant posts about AI customer service, Amazon FBA, Shopify — posts genuine AI-generated...

Security Scan

The skill's code and runtime instructions broadly match a Reddit/X auto-reply bot, but there are several inconsistencies and operational risks you should understand before installing.

Purpose & Capability

The skill claims to be a social auto-reply bot (Reddit + X) which legitimately needs a Claude/Anthropic API key and a browser automation CLI, and the code uses those. However the registry metadata declares no required environment variables or binaries while SKILL.md and the source require ANTHROPIC_API_KEY and the 'browse' CLI. That mismatch between declared requirements and actual code/instructions is incoherent and should be clarified.

Instruction Scope

SKILL.md instructs you to run a one-line installer (curl | bash) from the GitHub repo and to log into your Reddit and X accounts in a browse-controlled Chrome window. The runtime instructions and code will automate browsing, click Google OAuth selectors, post comments, and run a Reddit 'warmup' mode that posts multiple comments. These actions stay within the stated purpose but require interacting with your logged-in browser sessions and performing automated posts — a high-impact capability that should be explicitly acknowledged.

Install Mechanism

There is no formal install spec in the registry, but SKILL.md/README direct users to curl the project's install.sh from raw.githubusercontent.com and pipe it to bash. Although hosted on GitHub (better than a personal IP), piping remote install scripts to shell is high-risk and the installer is described as cloning the repo, installing dependencies, initializing an SQLite DB, and registering a macOS LaunchAgent. You should inspect install.sh and setup.sh before running them.

Credentials

The code explicitly requires ANTHROPIC_API_KEY (and optionally BROWSERBASE_API_KEY / PROJECT_ID). The registry metadata listed no required env vars or primary credential, which is inaccurate. Those environment variables are necessary for the bot to function (AI generation and optional persistent browser sessions). No other unrelated credentials are requested in the code, which is proportionate — but the metadata mismatch is problematic.

Persistence & Privilege

The installer will (per README) register a macOS LaunchAgent to run daily and create files under ~/social-bot and a logs directory; the repo includes install/setup scripts that likely modify your system (install global npm packages, register scheduled jobs). The skill does not claim always:true, but it does request persistent scheduled execution on install — review and approve that behavior before installing.

What to consider before installing

Key things to check before installing: - The registry metadata omits requirements the code needs (it uses ANTHROPIC_API_KEY and the 'browse' CLI). Treat SKILL.md/README as authoritative and double-check they match what the installer will do. - Do NOT run curl ... | bash without inspection. Download install.sh and setup.sh from the repo and read them locally (or run them in an isolated VM/container) before executing. - The tool requires you to log into Reddit/X in an automated browser session; that gives the software the ability to post using your accounts. This can lead to account suspension if behavior violates platform policies. Consider using throwaway/test accounts first. - The installer registers a macOS LaunchAgent (persistent scheduled runs) and creates files under your home directory — if you don’t want persistent background jobs, skip the installer and run the code manually in a controlled environment. - The code contains hard-coded checks/strings (e.g., account names like 'mguozhen', 'VocAiSage', 'Hunter Guo') that indicate it was tailored to the author’s accounts; expect to review and adapt code before using it with your accounts. - Limit the Anthropic API key you use (billing/permissions) and monitor usage. If possible create a dedicated key with strict limits. - If you lack confidence auditing the install scripts or the code, run the project in an isolated VM or container (or avoid installing) and/or ask the author to provide a reproducible install manifest and to fix the registry metadata mismatches.

Automatically finds and replies to relevant Reddit and X/Twitter posts about ecommerce, Amazon FBA, and AI customer service. Also builds Reddit account karma and tracks potential customer leads.

Commands

social reply bot                  # run both platforms
social reply bot x only           # X/Twitter only
social reply bot reddit only      # Reddit only
social reply bot warmup           # build Reddit karma (8 comments)
social reply bot warmup 15        # warmup with custom target
social reply bot leads            # show potential customers found
social reply bot stats            # today's stats
social reply bot dashboard        # open web dashboard

Setup

curl -fsSL https://raw.githubusercontent.com/mguozhen/social-bot/main/install.sh | bash

Requirements

• browse CLI: npm install -g @browserbasehq/browse-cli
• Log in to Reddit and X in the browse-controlled Chrome window
• ANTHROPIC_API_KEY in .env

Features

Daily Reply Bot

• Searches subreddits and X for posts matching your product keywords
• Claude generates genuine, on-topic replies (not spam)
• Browser automation — no Reddit/X API key needed
• SQLite deduplication — never replies to the same post twice

Reddit Warmup (karma building)

• Visits low-moderation subreddits (r/karma, r/CasualConversation, r/self)
• Claude Haiku generates authentic short comments (no product mentions)
• Natural delays between posts (90–180s)
• Builds Comment Karma to unlock restricted subreddits

Lead Tracking

• Every replied post analyzed by Claude for customer potential
• Scored 1–10 with urgency level
• Extracts business type and pain points
• View with: social reply bot leads

Configuration

Edit ~/social-bot/config.json to set your subreddits, X search queries, product descriptions, and daily targets.