commit 0c88e26 · 2026-10-27 17:51 UTC · 10 findings · 11 passed · rules v2026.10.2
Deliverable specification and settlement
Audit Reference
/status/demo
Settlement Reference
st_a125862baf3449df
B2B Deliverable
Telemetry and Ecosystem Indexing
Settlement Amount
$210.00 USD (Settled)
Readiness score
76/100
0 P06 P14 P211 passed
Category scoresweighted
Discoverability72
Conversion92
Trust and community72
Security hygiene60
Maintenance80
Owner profile72
Audit scope (Telemetry and Ecosystem Indexing)GROWTH
✓Configuration checks across discoverability, README conversion, trust, security hygiene, CI and owner profile
✓Evidence link and copy-paste fix for every finding
✓HTML, Markdown and fixes.sh exports
✓Full file-tree scan for committed secrets, keys and vendored dependencies
✓Known-vulnerability lookup for every locked dependency version (OSV database)
✓AI and registry discoverability: llms.txt, MCP Registry, Smithery and Glama descriptors
Findings10 · ordered by severity, then effort
P1O03onezeroooo/obsidian-writing-buddy is not pinned on the onezeroooo profile
Owner profile · effort 1m
Evidence
- api:organization.pinnedItems=""
Fix
- Open github.com/onezeroooo -> Customize your pins -> select obsidian-writing-buddy.
P1S02No Dependabot or Renovate config: vulnerable dependencies stay pinned silently
Security hygiene · effort 1m
Evidence
- tree:.github/dependabot.yml not found
- tree:renovate.json not found
Fix
- Commit .github/dependabot.yml.
version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: weekly
P1D04No custom social preview: links shared on X, Slack, HN, Reddit render a generic card
Discoverability · effort 10m
Evidence
- api:repository.usesCustomOpenGraphImage=false
Fix
- Create a 1280x640 PNG (logo, name, one-line value prop).
- Settings -> General -> Social preview -> Edit -> Upload.
- https://github.com/onezeroooo/obsidian-writing-buddy/settings
P1M01No CI: no visible signal that the main branch builds and tests pass
Maintenance · effort 10m
Evidence
- tree:.github/workflows/ not found
- tree:no other CI config at root
Fix
- Add a minimal workflow: install, lint, test on push and pull_request.
- Add the status badge to the README header.
P1S01Default branch "main" has no protection or rulesets: force-push and history rewrite are possible
Security hygiene · effort 10m
Evidence
- api:branches/main.protected=false
- api:rules/branches/main=[]
Fix
- Settings -> Rules -> Rulesets -> New branch ruleset targeting the default branch.
- Enable: block force pushes, restrict deletions, require status checks.
- https://github.com/onezeroooo/obsidian-writing-buddy/settings/rules
P1T03No security policy: researchers have no private channel, vulnerabilities land in public issues
Trust and community · effort 10m
Evidence
- api:repository.isSecurityPolicyEnabled=false
Fix
- Add .github/SECURITY.md.
- Enable Settings -> Code security -> Private vulnerability reporting.
- https://github.com/onezeroooo/obsidian-writing-buddy/settings/security_analysis
# Security policy ## Reporting a vulnerability Please do not open public issues for security problems. Use GitHub private vulnerability reporting (Security tab -> Report a vulnerability) or email: <security-contact@your-domain>. We acknowledge reports within 3 business days.
P2C03README has no screenshot, GIF or diagram
Conversion · effort 10m
Evidence
Fix
- Add a GIF or screenshot of the tool in action directly under the title (before the first ## section).
- Store it in the repo (e.g. .github/assets/demo.gif) so it never breaks.
P2G01No llms.txt: AI coding assistants and LLM crawlers get no curated map of the docs
Discoverability · effort 10m
Evidence
- tree:llms.txt not found (root, docs/)
Fix
- Add llms.txt (llmstxt.org format): H1 project name, one-line summary, links to key docs and examples.
- Serve it from the homepage root too if you have a docs site.
# obsidian-writing-buddy > Writing Buddy - an AI-assisted long-form writing workspace for Obsidian. ## Docs - [README](https://github.com/onezeroooo/obsidian-writing-buddy#readme)
P2O02No organization profile README (onezeroooo/.github/profile/README.md)
Owner profile · effort 10m
Evidence
- api:repository(onezeroooo/.github) has no profile/README
Fix
- Create public repo onezeroooo/.github with profile/README.md.
P2T02Missing contribution scaffolding: CONTRIBUTING.md, CODE_OF_CONDUCT.md, .github/ISSUE_TEMPLATE/, .github/pull_request_template.md
Trust and community · effort 10m
Evidence
- tree:CONTRIBUTING.md not found (repo root, .github/, docs/, onezeroooo/.github defaults)
- tree:CODE_OF_CONDUCT.md not found (repo root, .github/, docs/, onezeroooo/.github defaults)
- tree:.github/ISSUE_TEMPLATE/ not found (repo root, .github/, docs/, onezeroooo/.github defaults)
- tree:.github/pull_request_template.md not found (repo root, .github/, docs/, onezeroooo/.github defaults)
Fix
- Insights -> Community standards lists and generates these files.
- Or define them once for all repos in onezeroooo/.github.
- https://github.com/onezeroooo/obsidian-writing-buddy/community
Peer benchmark3 peers
Top peer repositories indexed for GitHub search topic:typescript fork:false archived:false. All rows scored on identical deterministic rules.
| Repository | Index Reach | Score | Discoverability | Conversion | Trust and community | Security hygiene | Maintenance | Owner profile |
|---|---|---|---|---|---|---|---|---|
| onezeroooo/obsidian-writing-buddy | 246 | 78 | 80 | 92 | 72 | 60 | 80 | 72 |
| obsidianmd/obsidian-sample-plugin | 12,500 | 91 | 100 | 92 | 92 | 80 | 80 | 100 |
| SilentVoid13/Templater | 9,300 | 91 | 100 | 92 | 92 | 80 | 80 | 100 |
| javalent/admonitions | 6,100 | 91 | 100 | 92 | 92 | 80 | 80 | 100 |
Largest gaps versus best peer
- Discoverability: 80 vs 100 (obsidianmd/obsidian-sample-plugin)
- Trust and community: 72 vs 92 (obsidianmd/obsidian-sample-plugin)
- Security hygiene: 60 vs 80 (obsidianmd/obsidian-sample-plugin)
- Owner profile: 72 vs 100 (obsidianmd/obsidian-sample-plugin)
Passed checks11
✓D01Repository description is set
✓D02Topics cover language and domain
✓D06Published releases
✓C01README present
✓C02Install or quickstart near the top of README
✓C04README relative links and images resolve
✓T01Recognized license
✓T06Project is active
✓S06No secrets or vendored dependencies committed
✓M02Default branch checks green
✓O01Owner profile fields filled
Not applicable7
-S03no workflow files
-S04no workflow files
-S05no workflow files
-S07published library: lockfile optional
-M03fewer than 5 non-merge commits sampled
-V01no supported lockfile (package-lock.json, uv.lock, poetry.lock, Cargo.lock, pinned requirements.txt)
-G02not an MCP server
Generated from public GitHub API data. Every finding links to the observed API field or file line at commit 0c88e2681bc64e9dc48c41464d5eb1ec6542e749. No code was executed, no repository settings were changed.