← 返回 Skills 市场
Last30days Skill
作者
johnsonDevops
· GitHub ↗
· v1.0.0
3965
总下载
0
收藏
32
当前安装
1
版本数
在 OpenClaw 中安装
/install last30days-skill
功能描述
Research a topic from the last 30 days. Also triggered by 'last30'. Sources: Reddit, X, YouTube, web. Become an expert and write copy-paste-ready prompts.
安全使用建议
Install only if you are comfortable with the skill reading X/Twitter browser session cookies for authenticated search, sending your research topics to the listed providers, and keeping reports/raw responses locally. Avoid sensitive or confidential topics unless you first disable cookie-based X search and review or clear the output/cache/database files.
功能分析
Type: OpenClaw Skill
Name: last30days-skill
Version: 1.0.0
The skill is classified as suspicious due to several high-risk capabilities and vulnerabilities, despite its stated benign purpose. The most critical concern is a potential shell injection vulnerability in `SKILL.md` where user-controlled `$ARGUMENTS` are passed directly to a `bash` command executing `scripts/last30days.py`. While the Python script itself uses `argparse` to mitigate direct injection within Python, the initial `bash` execution is vulnerable if the OpenClaw agent does not sanitize `$ARGUMENTS`. Additionally, the vendored Node.js module (`scripts/lib/vendor/bird-search/`) accesses browser cookies for X.com authentication and dynamically fetches/executes JavaScript from X.com to update API endpoints, posing a supply chain vulnerability if X.com were compromised. The broad `Bash` and `Write` tool permissions in `SKILL.md` further amplify these risks.
能力评估
Purpose & Capability
The core purpose is coherent: it researches recent topics across Reddit, X, YouTube, and web sources. The material concern is that X search resolves auth_token and ct0 from local Safari/Chrome/Firefox browser cookies by default and sends them as an authenticated Twitter/X GraphQL session, while SKILL.md also says it does not access the user's X account.
Instruction Scope
The skill is intentionally broad, covering any topic and using Bash, Read, Write, AskUserQuestion, and WebSearch. It is user-invocable and has disable-model-invocation set, which reduces accidental autonomous use, but the open variant accepts natural-language watchlist commands and should be used deliberately.
Install Mechanism
Installation is documented as a git clone plus local API-key configuration. Older planning docs mention global npm installation, but the current runtime vendors the Bird search wrapper and install_bird is a no-op, so those plan-file install concerns are not active behavior.
Credentials
The skill needs network and local execution for its stated purpose, but it reads local API-key config, may read browser cookie stores for X auth, calls multiple third-party providers, and writes reports plus raw provider responses to local disk. Those capabilities are powerful but only partly surfaced in the top-level security text.
Persistence & Privilege
One-shot mode writes report and raw response files under ~/.local/share/last30days/out, cache files under ~/.cache/last30days, and the open/watchlist mode stores accumulated findings and briefings in SQLite/local JSON. Scheduling is not automatic without cron or another external runner, but the persistence is broad enough to require explicit user awareness.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install last30days-skill - 安装完成后，直接呼叫该 Skill 的名称或使用
/last30days-skill触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
last30days-skill v1.0.0 — Initial Release
- Enables research on any topic discussed in the last 30 days across Reddit, X, YouTube, and the web.
- Automatically parses user intent to identify topic, target tool, and research type before any research begins.
- Transparently displays parsed user intent to confirm understanding before running research scripts.
- Performs a comprehensive foreground research script combining recent Reddit/X/YouTube data, followed by focused WebSearch.
- Synthesizes findings to deliver actionable, copy-paste-ready prompts or insights, grounded in up-to-date, real-world discussions.
元数据
常见问题
Last30days Skill 是什么？
Research a topic from the last 30 days. Also triggered by 'last30'. Sources: Reddit, X, YouTube, web. Become an expert and write copy-paste-ready prompts. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 3965 次。
如何安装 Last30days Skill？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install last30days-skill」即可一键安装，无需额外配置。
Last30days Skill 是免费的吗？
是的，Last30days Skill 完全免费（开源免费），可自由下载、安装和使用。
Last30days Skill 支持哪些平台？
Last30days Skill 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Last30days Skill？
由 johnsonDevops（@johnsondevops）开发并维护，当前版本 v1.0.0。
推荐 Skills