- • Hoping ClawdBot security gets patched
- • Non-technical users vibe-coding security (false safety)
- • $500-5,000/month variable API bills
- • 42,665 exposed instances — CVSS 9.6, 93.4% auth bypass
- • 3 CVEs filed (command injection, unauth access, arbitrary file access)
- • Someone else controls your AI infrastructure
- • You own the entire stack
- • $200/month fixed on Claude Max plan
- • Runs on your machine — no exposed instances
- • 2-hour rebuild (if you already use Claude Code)
- • Sky's the limit on customization
"Infostealer malware disguised as an AI personal assistant." — Heather Adkins, VP Security Engineering, Google Cloud
"My current favorite for the most likely Challenger disaster in coding agent security." — Simon Willison, AI Researcher
"22% of enterprise customers have employees actively using Clawdbot. Shadow AI risk is real." — Token Security Research
🔒 Full Security Comparison: ClawdBot vs. Claude Code
| Vulnerability | ClawdBot | Claude Code |
|---|---|---|
| Network Exposure | Public WebSocket :18789 | Local only, no ports |
| Credential Storage | Plaintext JSON files | MCP OAuth, env vars |
| Authentication | None by default | User ID restriction |
| Execution Model | Auto-execute all | Permission-gated |
| Sandboxing | None | Claude Code sandbox |
CVEs: CVE-2025-6514 (command injection), CVE-2025-49596 (unauthenticated access), CVE-2025-52882 (arbitrary file access). 26% of 31,000 ClawdBot skills had vulnerabilities.
📊 Feature Comparison: ClawdBot vs. Claude Code Always-On
| Feature | ClawdBot | Claude Code |
|---|---|---|
| 24/7 Operation | ✓ | ✓ |
| Voice Messages | ✓ | ✓ |
| Phone Calls | ✗ | ✓ |
| Semantic Memory | ✗ | ✓ |
| Security | 42K exposed | Private |
| Your Infrastructure | ✗ | ✓ |
🤖 AI Prompt: Assess Your Starting Point
Use this prompt to have Claude Code audit your current setup and identify what you already have vs. what you need to build.
I want to build a 24/7 AI assistant accessible via Telegram with:
1. Always-on Claude Code (headless)
2. Telegram bot relay for messaging
3. Persistent memory (Supabase or local)
4. Bidirectional voice calling (11 Labs + Twilio)
5. Proactive check-ins (calendar, email, tasks)
6. Observability dashboard
Audit my current Claude Code setup:
- What skills/MCP servers do I already have?
- What integrations exist (Google, Notion, etc.)?
- What's my OS and environment?
Then create a GAP ANALYSIS:
- What I already have (list with ✅)
- What I need to build (list with ❌)
- Estimated time per gap
- Recommended build order
Output as a structured checklist I can follow.
📊 Cost Comparison: ClawdBot vs. Build Your Own
ClawdBot (Hosted)
- • Heartbeat only: ~$150/month
- • Active use: $500-5,000/month
- • Opus 4.5 API burns fast
- • Variable, unpredictable
- • Security: 42K exposed instances
Your Own (Claude Code)
- • Claude Max: $200/month (fixed)
- • Supabase: Free tier
- • 11 Labs + Twilio: $11-20/month
- • Total: ~$250/month fixed
- • Security: Your machine only
- • Claude Code only runs when terminal is open
- • Close laptop lid = assistant goes dark
- • No way for external services to trigger it
- • Manual start every session
- • Claude Code runs as background service
- • Survives terminal close and sleep settings
- • Listens for incoming requests continuously
- • Auto-restarts if process crashes
🤖 AI Prompt: Configure Headless Claude Code
I need to run Claude Code 24/7 in headless mode on my [Mac/Windows/Linux].
Requirements:
1. Claude Code runs as background process
2. Survives terminal close
3. Auto-restarts on crash
4. Logs output to file for debugging
5. Can receive external triggers (HTTP/webhook)
My OS: [YOUR OS]
My Claude Code location: [PATH]
Generate:
1. Complete setup script for my OS
2. Process manager config (PM2 or systemd)
3. Startup script that runs on boot
4. Health check command I can run to verify it's alive
5. Log rotation config so logs don't fill disk
6. Troubleshooting guide for common issues
Make it copy-paste ready for my OS.
🔧 Technical: 2-Hour Time Limit Strategy
GodaGoo implemented a 2-hour limit on continuous autonomous action — the assistant can work on tasks for up to 2 hours, then must report back. This prevents runaway operations and keeps you in control. Configure this in your Claude Code settings or as a skill that wraps task execution with a timer and mandatory checkpoint.
💻 Cross-Platform Daemon Setup (macOS / Linux / Windows)
macOS — LaunchAgent
Keeps the bot running and restarts on crash. Copy template from repo's daemon/launchagent.plist to ~/Library/LaunchAgents/, edit paths, then:
launchctl load ~/Library/LaunchAgents/com.claude.telegram-relay.plist
launchctl list | grep claude
tail -f ~/Library/Logs/claude-telegram-relay.logLinux — systemd
Copy daemon/claude-relay.service to /etc/systemd/system/, edit paths and user, then:
sudo systemctl daemon-reload
sudo systemctl enable claude-relay
sudo systemctl start claude-relay
journalctl -u claude-relay -fWindows — PM2 (Recommended)
npm install -g pm2
pm2 start src/relay.ts --interpreter bun --name claude-relay
pm2 save
pm2 startup # run the command it outputsAlternatives: Windows Task Scheduler (built-in) or NSSM (turns any script into a Windows service). See the GitHub repo for full instructions on all three.
🧩 Core Pattern: The Minimal Spawn
The entire relay is built on one simple pattern — spawn the Claude CLI with a prompt and return the output:
claude -p "[prompt]" --output-format textWhy CLI spawn vs. API? The CLI gives you everything: tools, MCP servers, context management, permissions. The API is just the model. Overhead is ~1-2 seconds per spawn — fine for a personal assistant.
For session continuity across messages, use the --resume flag:
claude -p "[prompt]" --resume [sessionId] --output-format text- • Must be at terminal to use Claude Code
- • No mobile access to your AI
- • Can't send voice or files remotely
- • Zero integration with messaging
- • Message your AI from anywhere (phone, tablet, any device)
- • Send text, voice, images, files — all processed
- • AI sends back text, voice replies, files, images
- • Full Claude Code power in your pocket
🤖 AI Prompt: Set Up Telegram Relay
I need to connect Claude Code to Telegram so I can message my AI from anywhere.
Architecture:
- Telegram Bot ↔ BUN Relay ↔ Claude Code (headless)
- Bidirectional: I send messages, AI responds
- Supports: text, voice messages, images, files
- Grammy framework for Telegram API
I've already:
- Created Telegram bot via @BotFather (token: [REDACT BEFORE PASTING])
- Cloned https://github.com/godagoo/claude-telegram-relay
- Have BUN installed
Help me:
1. Configure the relay with my bot token
2. Connect it to my headless Claude Code instance
3. Set up message routing (text → text, voice → transcribe → process → voice reply)
4. Add file handling (receive files, process, send back results)
5. Security: Only allow MY Telegram user ID to interact
6. Start both services together (Claude Code + relay)
Generate complete config files and startup script.
My OS: [YOUR OS]
My Telegram user ID: [YOUR ID]
🎯 Validation: What "Working" Looks Like
Test These Inputs
- • Send "What time is it?" → get text response
- • Send voice message → get text summary back
- • Send screenshot → get description
- • Send PDF → get summary
- • Ask it to "check my email" → triggers Gmail skill
Verify These Behaviors
- • Response time under 30 seconds
- • All Claude Code skills accessible
- • MCP servers reachable through Telegram
- • Only YOUR messages get processed
- • Errors handled gracefully (no crashes)
- • Every conversation starts from zero
- • Can't recall yesterday's discussion
- • No goal tracking across sessions
- • Must re-explain context every time
- • "Remember what we talked about yesterday?" → Yes.
- • Semantic search across all past conversations
- • Goal detection: facts vs. goals vs. reminders
- • Post-call summaries stored automatically
🤖 AI Prompt: Build Memory System
Build a persistent memory system for my 24/7 AI assistant using Supabase.
REQUIREMENTS:
1. STORAGE:
- conversations table (timestamp, participants, summary, full_text)
- goals table (description, status, created_at, deadline)
- facts table (key, value, source, confidence)
- learnings table (insight, context, created_at)
2. SEMANTIC SEARCH:
- Enable pgvector in Supabase
- Generate embeddings for all stored content
- Similarity search with configurable threshold
- Combined search: timestamp + keywords + semantic
3. CONTEXT FETCHING:
- fetchRecentContext(hours=24) → last day's conversations
- fetchByKeyword(terms) → keyword-matched memories
- fetchSemantic(query, limit=5) → most relevant memories
- fetchGoals(status='active') → current goals
4. AUTO-CLASSIFICATION:
- During conversation, detect and categorize:
* Goals ("I want to...", "by next week...")
* Facts ("My dog's name is...", "The API key is...")
* Reminders ("Don't forget to...", "Remind me...")
* Learnings ("Interesting, so...")
5. WRITE PIPELINE:
- After every conversation: store summary + full text
- After every voice call: store transcript + summary
- Periodically: consolidate + deduplicate
Generate:
- Supabase SQL schema (tables, indexes, functions)
- Node.js/Python integration code
- Context fetching utility functions
- Auto-classification prompt for Claude
- Test script to verify the system works
- • Text-only interaction
- • Can't talk to your AI on the go
- • No hands-free operation
- • No post-call action execution
- • Call your AI from any phone
- • AI can call YOU proactively
- • Natural voice conversation with full context
- • "Go research X, create analysis, call me back with results"
🤖 AI Prompt: Set Up Voice Calling
I want bidirectional voice calling with my 24/7 AI assistant.
STACK:
- 11 Labs: Conversational voice agent (speech synthesis)
- Twilio: Phone number provisioning + telephony
- Claude Code: Brain (processes requests, executes actions)
- Supabase: Memory (context loaded before call, transcript stored after)
BUILD:
1. INBOUND CALLS (I call AI):
- Twilio receives call on my number
- Verify caller ID matches my phone number
- If unauthorized → reject or play generic message
- If authorized → load context from memory system
- Connect to 11 Labs conversational agent
- 11 Labs agent powered by Claude Code
2. OUTBOUND CALLS (AI calls me):
- Triggered by: proactive check-in, task completion, urgent alert
- Claude Code triggers Twilio to call my number
- Same 11 Labs agent with pre-loaded context
3. CONTEXT PIPELINE:
- On call start: fetch last 24h conversations + active goals + pending tasks
- During call: real-time processing of my requests
- On call end: capture full transcript
4. POST-CALL ACTIONS:
- Store transcript in Supabase memory
- Generate summary → send to Telegram
- Execute any action items mentioned during call
- Update goals/tasks based on conversation
5. SECURITY:
- Caller ID whitelist (my numbers only)
- Rate limiting on calls
- Auto-hangup after 30 min max
Generate complete integration code and config for each component.
- • You must remember to check everything
- • Important emails slip through
- • Meetings sneak up without prep
- • AI only works when you ask it to
- • AI monitors calendar, email, tasks on schedule
- • Smart filtering: skip / text / call framework
- • "New sponsorship offer" → "Should I run evaluation?"
- • Cross-references email with partnerships in Notion
- • No contact if checked in <2 hours ago — unless truly urgent
- • 7-10am is sacred creative time — zero interruptions during peak hours
- • Quiet after 10pm — everything can wait until morning
- • Knows pickup times — reminds 30min before, not during
Reply Awareness: Checks your sent folder. If you already replied, it flags "ALREADY REPLIED on Jan 21" and won't nag you about it.
Partnership Memory: Tracks contact history. When you get the 4th email from the same company, it shows: "4th contact attempt. You quoted $8K on Jan 20. Status: awaiting response."
Action Buttons: Telegram messages include inline buttons — [📊 Evaluate] [😴 Snooze] for emails, [✅ Yes, call] [❌ Not now] for call escalation. One tap to act.
🤖 AI Prompt: Build Proactive Check-In System
Build a proactive check-in system for my 24/7 AI assistant.
SCHEDULE: Every 30 minutes via cron/launchd
DATA COLLECTION (all in parallel):
1. Gmail: Unread from last 7 days, identify partner/sponsor, check if already replied
2. Google Calendar: Today's events + next 3 days preview + conflict detection
3. Notion Tasks: Tasks marked "Now" + due today + P1 priority this week
4. Partnerships: Notion history lookup (previous quotes, outreach count)
5. Memory: Current goals, key facts, pending items
6. History: Last 3 days of chat + previous check-ins + call history
HARD GATING RULES (non-negotiable):
- No contact if checked in less than 2 hours ago (unless truly urgent)
- 7-10am is sacred creative time — ZERO interruptions
- Quiet after 10pm — everything waits until morning
- Know pickup/family times — remind 30min before, not during
DECISION FRAMEWORK (Critical — prevents noise):
For each finding, classify as:
SKIP (don't notify):
- Newsletter/marketing emails
- Already-reported items (check last check-in log)
- Low-priority task updates
- Calendar events 2+ hours away with no prep needed
TEXT via Telegram:
- New email from active partnership/client
- Calendar event in <1 hour needing prep
- Task deadline approaching (24 hours)
- Goal milestone reached
- Offer: "Want me to run [specific action]?"
CALL (urgent):
- Email from VIP contact requiring immediate response
- Calendar conflict detected
- Critical deadline missed
- System error requiring attention
ANTI-REPEAT LOGIC:
- Store each check-in's findings in memory
- Before sending notification, verify it wasn't already reported
- Track "conversation state" per topic (new → reported → acknowledged → resolved)
CONTEXT ENRICHMENT:
- When email arrives from known contact:
* Check Notion for active projects with that person
* Pull last 3 interactions from memory
* Show contact attempt count: "4th email from Agency X"
* Include previous quotes/pricing if applicable
* Include relevant context in notification
- REPLY AWARENESS: Check sent folder before alerting
* If already replied, flag "ALREADY REPLIED on [date]" and don't nag
- TELEGRAM ACTION BUTTONS: Include inline buttons with each notification
* Emails: [📊 Evaluate] [😴 Snooze] [✉️ Reply]
* Meetings: [📝 Prep] [⏰ Remind Later]
* Calls: [✅ Yes, call] [❌ Not now]
Generate:
1. Cron job configuration
2. Check-in orchestration script
3. Decision framework prompt (for Claude to evaluate each finding)
4. Anti-repeat logic with check-in log
5. Notification templates (Telegram + voice call trigger)
6. Test mode (run once and show what WOULD be sent)
📊 GodaGoo's Check-In Architecture
What Gets Checked
- • Calendar events
- • Email inbox
- • Active projects
- • Task lists
- • Partnership status
- • Goal progress
Smart Filter Examples
- • New sponsorship email → cross-ref with Notion partnerships → "New inquiry — run evaluation?"
- • Same email reported last check → SKIP
- • Meeting in 45 min → "Prep needed?"
- • Newsletter → auto-SKIP
- • No idea if assistant is running
- • Can't see what it's doing autonomously
- • Errors happen silently
- • No uptime or health tracking
- • Dashboard shows all service statuses
- • Live feed of agent actions
- • Uptime tracking (hours, days)
- • Goal tracking visualization
🤖 AI Prompt: Generate Observatory Dashboard
Build an observability dashboard for my 24/7 AI assistant system.
SERVICES TO MONITOR:
1. Claude Code (headless) - is process running?
2. Telegram Bot Relay - is bot online and responding?
3. Supabase - is database connected?
4. Voice System (11 Labs + Twilio) - are services reachable?
5. Proactive Check-Ins - is cron running? Last execution time?
DASHBOARD FEATURES:
- Service status cards (green/red with uptime counter)
- Live action feed (last 20 agent actions with timestamps)
- Goal tracker (active goals from Supabase with progress)
- Memory stats (total memories, recent additions)
- Error log (last 10 errors with details)
- Cost tracker (if applicable)
TECH:
- Simple HTML/CSS/JS (no framework needed)
- Polls API endpoints every 30 seconds
- Runs on localhost:3000
- Mobile responsive
Generate:
1. Complete HTML dashboard file
2. Backend API endpoints (Node.js/Express)
3. Health check functions for each service
4. Auto-refresh with visual indicators
5. Alert system (Telegram notification if service goes down)
All prompts from each step collected here for easy reference and batch copying.
Prompt 1: Assess Your Starting Point (Step 0)
I want to build a 24/7 AI assistant accessible via Telegram with:
1. Always-on Claude Code (headless)
2. Telegram bot relay for messaging
3. Persistent memory (Supabase or local)
4. Bidirectional voice calling (11 Labs + Twilio)
5. Proactive check-ins (calendar, email, tasks)
6. Observability dashboard
Audit my current Claude Code setup and create a GAP ANALYSIS:
- What I already have (✅) vs. What I need to build (❌)
- Estimated time per gap
- Recommended build order
Output as a structured checklist.Prompt 2: Configure Headless Claude Code (Step 1)
Run Claude Code 24/7 headless on [YOUR OS].
Requirements: background process, survives terminal close, auto-restart on crash, logs to file, accepts external triggers.
Generate: setup script, PM2/systemd config, startup-on-boot script, health check command, log rotation, troubleshooting guide. Copy-paste ready.Prompt 3: Telegram Bot Relay (Step 2)
Connect Claude Code to Telegram via BUN relay + Grammy.
My bot token: [TOKEN]. My Telegram user ID: [ID].
Set up: message routing (text/voice/files), security (only my ID), bidirectional file transfer.
Generate complete config + startup script for [YOUR OS].Prompt 4: Memory System (Step 3)
Build persistent memory using Supabase with pgvector.
Tables: conversations, goals, facts, learnings.
Features: semantic search, auto-classification (goal/fact/reminder), anti-duplicate, context fetching by time+keyword+semantic.
Generate: SQL schema, integration code, classification prompt, test script.Prompt 5: Voice Calls (Step 4)
Build bidirectional voice calling: 11 Labs (voice) + Twilio (phone) + Claude Code (brain) + Supabase (memory).
Inbound: verify caller ID → load context → connect to voice agent.
Outbound: AI triggers call to my number with pre-loaded context.
Post-call: transcript → summary → Telegram → memory.
Security: caller ID whitelist, rate limiting, 30 min max.
Generate complete integration code.Prompt 6: Proactive Check-Ins (Step 5)
Build proactive check-in system running every 30 min.
Sources: Gmail, Calendar, Notion, partnerships.
Decision framework: SKIP (noise) / TEXT (important) / CALL (urgent).
Anti-repeat: log last check-in findings, don't re-report.
Context enrichment: cross-reference senders with active projects.
Generate: cron config, orchestration script, decision prompt, anti-repeat logic, notification templates.Prompt 7: Observability Dashboard (Step 6)
Build HTML observability dashboard for my AI assistant.
Monitor: Claude Code, Telegram Bot, Supabase, Voice System, Check-Ins.
Features: service status cards, live action feed, goal tracker, error log, auto-refresh every 30s.
Generate: complete HTML file + backend API + health checks + Telegram alert if service goes down.