← 返回 Skills 市场

Last 30 Days

Name: Last 30 Days
Author: johnsondevops

作者 johnsonDevops · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

6720

总下载

当前安装

版本数

在 OpenClaw 中安装

/install last30days-skill

功能描述

Research any topic across Reddit, X, YouTube, and the web from the last 30 days. Returns synthesized expert answers and copy-paste prompts.

安全使用建议

Install only if you are comfortable with the skill reading X browser session cookies and writing research topics/results to local files. Prefer explicit API-key or manually supplied-token modes, audit or pin the missing cookie dependency before enabling X cookie auth, and avoid sensitive topics on shared machines until output permissions and temp-file handling are fixed.

功能分析

Type: OpenClaw Skill Name: last30days-skill Version: 1.0.0 The skill is classified as suspicious due to several high-risk capabilities and vulnerabilities, despite its stated benign purpose. The most critical concern is a potential shell injection vulnerability in `SKILL.md` where user-controlled `$ARGUMENTS` are passed directly to a `bash` command executing `scripts/last30days.py`. While the Python script itself uses `argparse` to mitigate direct injection within Python, the initial `bash` execution is vulnerable if the OpenClaw agent does not sanitize `$ARGUMENTS`. Additionally, the vendored Node.js module (`scripts/lib/vendor/bird-search/`) accesses browser cookies for X.com authentication and dynamically fetches/executes JavaScript from X.com to update API endpoints, posing a supply chain vulnerability if X.com were compromised. The broad `Bash` and `Write` tool permissions in `SKILL.md` further amplify these risks.

能力评估

⚠ Credentials

Network calls to listed providers are expected for the research purpose, but default browser-cookie access, Keychain/browser profile prompts, yt-dlp execution, and local output of raw provider responses are substantial and should be explicitly scoped before use.

⚠ Install Mechanism

The README uses a normal clone-and-config setup, but the vendored X client imports @steipete/sweet-cookie without declaring or pinning it in package metadata or including a lockfile, so a sensitive cookie-reading component may resolve from outside the reviewed artifact.

⚠ Instruction Scope

The active skill is mostly scoped to research and synthesis, but its security text says it cannot be invoked autonomously while Codex metadata allows implicit invocation, and the bundled open variant asks the agent to update persistent context after interactions.

⚠ Persistence & Privilege

Normal runs write reports and raw responses under ~/.local/share/last30days/out, caches are written under user config/cache paths, and SQLite persistence is available for watchlists; some of this is disclosed, but normal report/raw-output persistence and temporary-directory fallback are not clearly described in the skill's security summary.

⚠ Purpose & Capability

The core purpose of recent-topic research across Reddit, X, YouTube, and web sources is coherent, but the X path uses authenticated browser session cookies and a cookie-reading JavaScript dependency, which is higher-impact than ordinary public research.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install last30days-skill
安装完成后，直接呼叫该 Skill 的名称或使用 /last30days-skill 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

last30days-skill v1.0.0 — Initial Release - Enables research on any topic discussed in the last 30 days across Reddit, X, YouTube, and the web. - Automatically parses user intent to identify topic, target tool, and research type before any research begins. - Transparently displays parsed user intent to confirm understanding before running research scripts. - Performs a comprehensive foreground research script combining recent Reddit/X/YouTube data, followed by focused WebSearch. - Synthesizes findings to deliver actionable, copy-paste-ready prompts or insights, grounded in up-to-date, real-world discussions.

元数据

Slug last30days-skill

版本 1.0.0

许可证 —

累计安装 0

当前安装数 0

历史版本数 1

常见问题

Last 30 Days 是什么？

Research any topic across Reddit, X, YouTube, and the web from the last 30 days. Returns synthesized expert answers and copy-paste prompts. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 6720 次。

如何安装 Last 30 Days？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install last30days-skill」即可一键安装，无需额外配置。

Last 30 Days 是免费的吗？

是的，Last 30 Days 完全免费（开源免费），可自由下载、安装和使用。

Last 30 Days 支持哪些平台？

Last 30 Days 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 Last 30 Days？

由 johnsonDevops（@johnsondevops）开发并维护，当前版本 v1.0.0。