last30days
An agent skill by mvanhorn, from mvanhorn/last30days-skill. Tags: api, debugging, reddit, social-listening, trend-analysis, web.
What it does
Research what people actually say about any topic in the last 30 days. Pulls posts and engagement from Reddit, X, YouTube, TikTok, Hacker News, Polymarket, GitHub, and the web. Includes a doctor health check to diagnose broken or missing sources.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add mvanhorn/last30days-skill --skill last30daysOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/mvanhorn/last30days-skill
cp -r last30days-skill/skills/last30days ~/.claude/skills/last30daysSafety box score
Grade F, high risk: 96 of 100 risk points, rated 2026-09-22. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This is a broad research-and-sharing skill that shells out to Python/Bash, installs helper CLIs, queries many external platforms, and can read browser cookies or write config in the user’s home directory. The main risks are secret handling, remote installer execution, and a large amount of instruction pressure that steers the agent to skip confirmations and act autonomously on the user’s behalf.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 3 (high) | It runs shell commands and native scripts throughout, and even permits a remote installer path like `curl -fsSL https://x.ai/cli/install.sh | bash` plus package installs such as `brew install yt-dlp` and `npx @mvanhorn/printing-press-library install digg --cli-only`. |
| Network access | 3 (high) | It sends search and fetch traffic to many remote services - `api.scrapecreators.com`, `api.x.com`, Reddit, HN, Polymarket, YouTube, TikTok, Instagram, Perplexity, Brave/Exa/Serper - and can publish library content to `ht-ml.app`. |
| Filesystem reach | 3 (high) | It reads and writes outside the project, including `~/.config/last30days/.env`, browser cookie stores / Keychain / Pass, and local library artifacts under the home directory. |
| Secrets & credentials | 3 (high) | It explicitly touches browser cookies, credential stores, and tokens like `AUTH_TOKEN`, `CT0`, `X_BEARER_TOKEN`, `XAI_API_KEY`, `SCRAPECREATORS_API_KEY`, and `BROWSER_CDP_URL`. |
| Privilege & persistence | 3 (high) | The skill asks for global installs and OS-level changes such as `sudo apt install python3.12`, `brew install python@3.12`, and browser Full Disk Access / cookie-access remediation. |
| Instruction hijack surface | 3 (high) | The file repeatedly overrides normal agent caution with commands like `LAW 1 overrides`, `do NOT ask another X question`, `You are the planner`, and `You are the judge`, which is strong instruction-pressure. |
| Irreversible actions | 2 (moderate) | It can mark topics as covered and publish/share a library or feed to `ht-ml.app`, but those actions are gated by explicit user consent rather than fully unattended. |
| Transparency | 3 (high) | Many shipped files were not read, including `scripts/last30days.py`, most of `scripts/lib/*`, `scripts/lib/vendor/bird-search/*`, and `references/save-html-brief.md`, so the runtime engine and publisher cannot be fully audited from the reviewed files. |
Before installing
- Read `scripts/last30days.py` and the unread `scripts/lib/*` modules before allowing it to run.
- Decide whether you are comfortable with browser-cookie reads and `~/.config/last30days/.env` writes.
- Avoid the remote installer path `curl -fsSL https://x.ai/cli/install.sh | bash` unless you trust it.
- Confirm you want any public publishing behavior (`ht-ml.app`) before using the library/feed features.
Rated 2026-09-22 by an automated review of 1 file from the skill's repository.
Source
- Repository
- mvanhorn/last30days-skill (all skills from this repository)
- Path
- skills/last30days/SKILL.md
- Branch
- main
- Updated
- 2026-09-19
Related skills
- debugging-and-error-recovery — Guides systematic root-cause debugging.
- django-expert — Use when building Django web applications or REST APIs with Django REST Framework.
- java-architect — Use when building, configuring, or debugging enterprise Java applications with Spring Boot 3.x, microservices.
- observability-and-instrumentation — Instruments code so production behavior is visible and diagnosable. Use when adding logging, metrics, tracing, or alerting.
- performance-optimization — Optimizes application performance across frontend, backend, queries, and databases.
- secure-code-guardian — Use when implementing authentication/authorization, securing user input.