SoloBuddy

Build-in-public companion for indie hackers — content workflow, Twitter engagement, project soul creation. A living assistant, not a tool.

What to watch for before installing/using SoloBuddy: - Core content features (backlog, drafts, generation) are coherent and operate only in a user-configured folder (dataPath). Those parts are low-risk if you point dataPath to a directory you control. - The optional Twitter Monitor is the biggest red flag: it instructs creating scripts in ~/.clawdbot/scripts, placing a LaunchAgent in ~/Library/LaunchAgents, writing logs to /tmp, and using the 'bird' CLI plus Twitter auth tokens (AUTH_TOKEN, CT0). If you enable this, inspect every script and the plist before running them. Prefer not to store secrets in plain ~/.zshrc; use a more secure credential store where possible. - The skill lists 'gh' as required but examples use git; verify whether you need to install 'gh' for any feature you plan to use. Don't blindly run install or bootstrap commands — inspect them. - The skill will read files under the configured dataPath and (for the Soul Wizard) will run a find on the project path you provide. Only point it at repositories you want it to analyze, not at your entire home directory. - If you plan to use Telegram/Clawdbot integration or automatic notifications, confirm how messages are delivered (clawdbot CLI) and what data is sent externally. Recommendation: treat the content-generation features as generally safe to try in a sandboxed project folder. If you want Twitter monitoring, review and audit the monitor scripts and the LaunchAgent plist, avoid storing tokens in shell rc files, and only enable background agents if you accept the ongoing activity and have inspected the code.

Type: OpenClaw Skill Name: solobuddy Version: 1.0.0 The skill is classified as suspicious due to several high-risk capabilities, even though direct malicious intent is not explicitly evident in the provided files. Key indicators include the use of a `LaunchAgent` for persistence (`modules/twitter-monitor.md`), broad file system access via `find` for scanning project documentation (`references/soul-wizard.md`), and reliance on powerful CLIs like `gh` (GitHub CLI) and `bird` (Twitter CLI). While these capabilities are plausibly related to the stated purpose of a 'build-in-public companion,' they significantly expand the attack surface. Furthermore, the `twitter-monitor.sh` and `twitter-analyze.sh` scripts, which are central to the monitoring functionality and executed by the `LaunchAgent`, are referenced but not provided for analysis within the bundle, preventing full verification of their benign nature.