Productclank Community GrowthSAFE

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

npm install -g @productclank/communiply-cli
communiply auth register MyAgent
communiply boost https://x.com/myproduct/status/123 --action replies \
--guidelines "Congratulate the team, ask about features"

export PRODUCTCLANK_API_KEY=pck_live_YOUR_KEY
node scripts/create-campaign.mjs    # Discover flow
node scripts/boost-tweet.mjs        # Boost flow

productclank-campaigns/
├── SKILL.md                    # Main skill documentation (loaded by agents)
├── README.md                   # Th

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: productclank-campaigns
description: Community-powered growth for builders. Boost amplifies your social posts with authentic community engagement (replies, likes, reposts). Discover finds relevant conversations and generates AI-powered replies at scale. Use Boost when the user has a post URL. Use Discover when the user wants to find and engage in conversations about their product.
license: Proprietary
metadata:
  author: ProductClank
  version: "3.0.0"
  api_endpoint: https://app.productclank.com/api/v1/agents
  website: https://www.productclank.com
  web_ui: https://app.productclank.com/communiply/
  cli: https://github.com/covariance-network/communiply-cli
compatibility: Requires ProductClank credits. Credits can be purchased via the webapp or topped up via the API using USDC on Base (chain ID 8453).
---

# ProductClank — Community-Powered Growth for Builders

Turn your community into a growth engine. Launch campaigns where real people amplify your product across social platforms — authentic engagement, not bots.

Supports Twitter/X, Instagram, TikTok, LinkedIn, Reddit, and Farcaster.

## Capability 1: Boost

**Amplify a specific social post with community-powered engagement.**

Use Boost when the user has a post URL they want to amplify. One API call, instant results. Works across platforms — just pass the URL.

### Supported Platforms

| Platform | Replies | Likes | Reposts |
|----------|---------|-------|---------|
| Twitter/X | Yes | Yes | Yes |
| Instagram | Yes | Yes | — |
| TikTok | Yes | Yes | — |
| LinkedIn | Yes | Yes | — |
| Reddit | Yes | Yes | — |
| Farcaster | Yes | Yes | Yes |

### How It Works
1. Provide a post URL from any supported platform
2. Platform is auto-detected from the URL
3. Choose action: replies, likes, or reposts (availability varies by platform)
4. Community members execute from their personal accounts
5. You get authentic, third-party engagement

### Pricing

| Action | What You Get | Credits |
|--------|-------------|---------|
| Replies | 10 AI-generated reply threads | 200 |
| Likes | 30 community likes | 300 |
| Reposts | 10 community reposts | 300 |

### API

```
POST /api/v1/agents/campaigns/boost
```

```json
{
  "post_url": "https://x.com/user/status/123456",
  "product_id": "product-uuid",
  "action_type": "replies",
  "reply_guidelines": "optional custom instructions",
  "post_text": "optional — pass post text to skip server-side fetch",
  "post_author": "optional — post author username (used with post_text)"
}
```

> `tweet_url`, `tweet_text`, and `tweet_author` are still accepted for backward compatibility.

**Response:**
```json
{
  "success": true,
  "campaign": {
    "id": "uuid",
    "campaign_number": "CP-042",
    "platform": "twitter",
    "url": "https://app.productclank.com/communiply/uuid"
  },
  "post": {
    "id": "123456789",
    "url": "https://x.com/user/status/123456789",
    "text": "Post content...",
    "author": "username",
    "platform": "twitter"
  },
  "items_generated": 10,
  "credits": {
    "credits_used": 200,
    "credits_remaining": 100
  }
}
```

**Consolidation:** All boost actions for the same product share one campaign. Boosting again adds to the existing campaign (`is_reboost: true`).

### When to Use Boost
- "Boost this post" / "get engagement on my announcement"
- "Get community replies on my LinkedIn post"
- "Get likes on my tweet" / "get reposts on my cast"
- User shares a post URL from any platform and wants community engagement
- Launch announcements, product updates, partnership posts — any post you want your community to rally behind

### How to Run a Boost (Agent Interaction Guide)

1. **Get the post URL** — ask the user for their post URL (the post they want community to engage with). Any supported platform works.
2. **Choose action type** — ask: "How should the community engage? Replies (support, questions, congrats), likes, or reposts?" Default to replies if unclear. Note: reposts only available on Twitter and Farcaster.
3. **Find the product** — search `GET /agents/products/search?q=<name>` and confirm with user (see [Confirm Product Selection](#confirm-product-selection-required))
4. **Get reply guidelines** (for replies) — ask what kind of engagement they want: "Should community replies congratulate the team? Ask about features? Show excitement?" Use this to set `reply_guidelines`
5. **Confirm cost** — "This will use 200 credits for 10 community replies. Proceed?"
6. **Execute** — `POST /agents/campaigns/boost`
7. **Share results** — show campaign URL and credits remaining

### Complete Boost Example

```typescript
// User says: "Get my community to engage with my latest announcement"
const API = "https://app.productclank.com/api/v1/agents";
const headers = {
  "Authorization": `Bearer ${process.env.PRODUCTCLANK_API_KEY}`,
  "Content-Type": "application/json",
};

// 1. Search for the product
const search = await fetch(`${API}/products/search?q=MyProduct&limit=5`, { headers });
const { products } = await search.json();
// → Confirm with user: "I found MyProduct. Is this correct?"

// 2. Boost a Twitter post
const res = await fetch(`${API}/campaigns/boost`, {
  method: "POST",
  headers,
  body: JSON.stringify({
    post_url: "https://x.com/myproduct/status/123456789",
    product_id: products[0].id,
    action_type: "replies",
    reply_guidelines: "Show genuine excitement about the launch. Ask thoughtful questions about the new features or congratulate the team. Keep it authentic — no sales pitch.",
    post_text: "We just shipped v2.0! New API with 10x faster response times, batch endpoints, and webhook support. Try it out →", // optional, skips server fetch
    post_author: "myproduct", // optional, used with post_text
  }),
});

const result = await res.json();

if (result.success) {
  console.log(`✅ Boosted on ${result.campaign.platform}! ${result.items_generated} community replies generated`);
  console.log(`📊 Dashboard: ${result.campaign.url}`);
  console.log(`💰 Credits remain

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

declared (2 observation(s))

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (3)

<key>k5Ey9KFlkqpj+SDkUw+5ED9lTA3En/qUi0zdrydUCH3kMWTE3Eh65NXnFCaxlY2omY2JHnlEoK7Li7oOEvM7eG5VPdcO/sFlMfoCRdnLYdepJ+uLzYwOWR8W4yQVve/clxVFTVRL4DFleKInGdpAxIbHZT2yi4ADAMENls1N1XSLojRuqXePXDeAT/4Mv4TTx0s

| POST | `/api/v1/agents/telegram/create-link` | Generate a linking token for a Telegram user |

| POST | `/agents/telegram/create-link` | Bearer (trusted) | Free | Generate Telegram linking token |

Gates applied: no_behavioural_pass.