# Repository Telemetry & AST Discovery: onezeroooo/obsidian-writing-buddy

- Tier: **GROWTH**
- Commit: `0c88e26` (2026-10-27)
- Rules: v2026.10.2, 10 findings, 11 passed, 7 skipped
- Score: **76/100**

Scope:
- Configuration checks across discoverability, README conversion, trust, security hygiene, CI and owner profile
- Evidence link and copy-paste fix for every finding
- HTML, Markdown and fixes.sh exports
- Full file-tree scan for committed secrets, keys and vendored dependencies
- Known-vulnerability lookup for every locked dependency version (OSV database)
- AI and registry discoverability: llms.txt, MCP Registry, Smithery and Glama descriptors

| Category | Weight | Score |
|---|---|---|
| Discoverability | 25 | 72 |
| Conversion | 25 | 92 |
| Trust and community | 20 | 72 |
| Security hygiene | 15 | 60 |
| Maintenance | 10 | 80 |
| Owner profile | 5 | 72 |

## Findings

### [P1] O03: onezeroooo/obsidian-writing-buddy is not pinned on the onezeroooo profile

Category: Owner profile. Effort: 1m.

Evidence:
- `api:organization.pinnedItems=""`

Fix:
- Open github.com/onezeroooo -> Customize your pins -> select obsidian-writing-buddy.

### [P1] S02: No Dependabot or Renovate config: vulnerable dependencies stay pinned silently

Category: Security hygiene. Effort: 1m.

Evidence:
- `tree:.github/dependabot.yml not found`
- `tree:renovate.json not found`

Fix:
- Commit .github/dependabot.yml.

```
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: weekly
```

### [P1] D04: No custom social preview: links shared on X, Slack, HN, Reddit render a generic card

Category: Discoverability. Effort: 10m.

Evidence:
- `api:repository.usesCustomOpenGraphImage=false`

Fix:
- Create a 1280x640 PNG (logo, name, one-line value prop).
- Settings -> General -> Social preview -> Edit -> Upload.
- Settings: https://github.com/onezeroooo/obsidian-writing-buddy/settings

### [P1] M01: No CI: no visible signal that the main branch builds and tests pass

Category: Maintenance. Effort: 10m.

Evidence:
- `tree:.github/workflows/ not found`
- `tree:no other CI config at root`

Fix:
- Add a minimal workflow: install, lint, test on push and pull_request.
- Add the status badge to the README header.

### [P1] S01: Default branch "main" has no protection or rulesets: force-push and history rewrite are possible

Category: Security hygiene. Effort: 10m.

Evidence:
- `api:branches/main.protected=false`
- `api:rules/branches/main=[]`

Fix:
- Settings -> Rules -> Rulesets -> New branch ruleset targeting the default branch.
- Enable: block force pushes, restrict deletions, require status checks.
- Settings: https://github.com/onezeroooo/obsidian-writing-buddy/settings/rules

### [P1] T03: No security policy: researchers have no private channel, vulnerabilities land in public issues

Category: Trust and community. Effort: 10m.

Evidence:
- `api:repository.isSecurityPolicyEnabled=false`

Fix:
- Add .github/SECURITY.md.
- Enable Settings -> Code security -> Private vulnerability reporting.
- Settings: https://github.com/onezeroooo/obsidian-writing-buddy/settings/security_analysis

```
# Security policy

## Reporting a vulnerability

Please do not open public issues for security problems.
Use GitHub private vulnerability reporting (Security tab -> Report a vulnerability)
or email: <security-contact@your-domain>.

We acknowledge reports within 3 business days.
```

### [P2] C03: README has no screenshot, GIF or diagram

Category: Conversion. Effort: 10m.

Evidence:
- [file:README.md:1-9 0 images, all badges or none](https://github.com/onezeroooo/obsidian-writing-buddy/blob/0c88e2681bc64e9dc48c41464d5eb1ec6542e749/README.md#L1-L9)

Fix:
- Add a GIF or screenshot of the tool in action directly under the title (before the first ## section).
- Store it in the repo (e.g. .github/assets/demo.gif) so it never breaks.

### [P2] G01: No llms.txt: AI coding assistants and LLM crawlers get no curated map of the docs

Category: Discoverability. Effort: 10m.

Evidence:
- `tree:llms.txt not found (root, docs/)`

Fix:
- Add llms.txt (llmstxt.org format): H1 project name, one-line summary, links to key docs and examples.
- Serve it from the homepage root too if you have a docs site.

```
# obsidian-writing-buddy

> Writing Buddy - an AI-assisted long-form writing workspace for Obsidian.

## Docs

- [README](https://github.com/onezeroooo/obsidian-writing-buddy#readme)
```

### [P2] O02: No organization profile README (onezeroooo/.github/profile/README.md)

Category: Owner profile. Effort: 10m.

Evidence:
- `api:repository(onezeroooo/.github) has no profile/README`

Fix:
- Create public repo onezeroooo/.github with profile/README.md.

### [P2] T02: Missing contribution scaffolding: CONTRIBUTING.md, CODE_OF_CONDUCT.md, .github/ISSUE_TEMPLATE/, .github/pull_request_template.md

Category: Trust and community. Effort: 10m.

Evidence:
- `tree:CONTRIBUTING.md not found (repo root, .github/, docs/, onezeroooo/.github defaults)`
- `tree:CODE_OF_CONDUCT.md not found (repo root, .github/, docs/, onezeroooo/.github defaults)`
- `tree:.github/ISSUE_TEMPLATE/ not found (repo root, .github/, docs/, onezeroooo/.github defaults)`
- `tree:.github/pull_request_template.md not found (repo root, .github/, docs/, onezeroooo/.github defaults)`

Fix:
- Insights -> Community standards lists and generates these files.
- Or define them once for all repos in onezeroooo/.github.
- Settings: https://github.com/onezeroooo/obsidian-writing-buddy/community

## Peer benchmark

Peers: top by stars for GitHub search `topic:typescript fork:false archived:false`. Same baseline rules, shallow scan.

| Repository | Stars | Score | Discoverability | Conversion | Trust and community | Security hygiene | Maintenance | Owner profile |
|---|---|---|---|---|---|---|---|---|
| **onezeroooo/obsidian-writing-buddy** | 246 | 78 | 80 | 92 | 72 | 60 | 80 | 72 |
| obsidianmd/obsidian-sample-plugin | 12500 | 91 | 100 | 92 | 92 | 80 | 80 | 100 |
| SilentVoid13/Templater | 9300 | 91 | 100 | 92 | 92 | 80 | 80 | 100 |
| javalent/admonitions | 6100 | 91 | 100 | 92 | 92 | 80 | 80 | 100 |

Largest gaps versus best peer:
- Discoverability: 80 vs 100 (obsidianmd/obsidian-sample-plugin)
- Trust and community: 72 vs 92 (obsidianmd/obsidian-sample-plugin)
- Security hygiene: 60 vs 80 (obsidianmd/obsidian-sample-plugin)
- Owner profile: 72 vs 100 (obsidianmd/obsidian-sample-plugin)

## Passed checks

- D01: Repository description is set
- D02: Topics cover language and domain
- D06: Published releases
- C01: README present
- C02: Install or quickstart near the top of README
- C04: README relative links and images resolve
- T01: Recognized license
- T06: Project is active
- S06: No secrets or vendored dependencies committed
- M02: Default branch checks green
- O01: Owner profile fields filled

## Not applicable

- S03: no workflow files
- S04: no workflow files
- S05: no workflow files
- S07: published library: lockfile optional
- M03: fewer than 5 non-merge commits sampled
- V01: no supported lockfile (package-lock.json, uv.lock, poetry.lock, Cargo.lock, pinned requirements.txt)
- G02: not an MCP server

---
Generated from public GitHub data at 2026-10-27T17:48:05.458Z. Every finding links to the observed field or file line at commit 0c88e26.