mvanhorn's research skill: Given a topic, the agent runs the skill's built-in Python engine to parallelly scrape posts and engagement data from the past 30 days on Reddit, X, YouTube, TikTok, Hacker News, Polymarket, GitHub, and the web. It scores content based on engagement metrics like likes and votes, generates a briefing with inline citations, and can save it as local Markdown or HTML.
Security Audit: Not audited
- Not yet scanned
Rationale
- The author states that Reddit, Hacker News, Polymarket, and GitHub are usable without API keys, while X, YouTube, TikTok, etc., are configured during the initial setup wizard
- The workflow is strictly managed: the engine must be run, and using only web search as a substitute is prohibited; separate reference workflows exist for comparisons, competitors, hiring signals, and trend discovery; scraped web pages and posts are treated strictly as evidence, not as instructions
- SKILL.md specifies where queries are sent for each source (ScrapeCreators, X API, xAI, Algolia, Polymarket, etc.), under what circumstances credits are consumed, and explicitly states that browser cookies are not read without consent
- MIT licensed; the author claims no tracking or analytics, with research results remaining on the local machine; skills.sh 24-hour installs 780 (indicating popularity only)
Usage
- Installation commands will be displayed after the audit passes; triggered via slash commands, e.g., /last30days followed by a topic; the README also provides a Claude Code plugin method: /plugin marketplace add mvanhorn/last30days-skill
- Requires Python 3 and Node; optional keys for ScrapeCreators, OpenAI, xAI, X, OpenRouter, Perplexity, Brave, Apify, etc., with ScrapeCreators as the primary key (offering a free tier initially, then pay-as-you-go)
Risks
- Not audited in this cycle, fixed at C-level, installation commands hidden; SKILL.md instructs the agent to run built-in Python scripts and call multiple third-party APIs, and with consent, it may read X login cookies from the browser (or use manually entered AUTH_TOKEN / CT0); if ScrapeCreators is not configured, the APIFY_API_TOKEN is sent to ScrapeCreators; these behaviors align with the purpose of "cross-platform discussion scraping," but the scripts themselves have not been scanned; on skills.sh, the Gen Agent Trust Hub audit result is Fail, Socket is Warn, and Snyk is Pass
- Using browser login states to scrape X may violate platform terms of service and pose a risk of account bans; README examples include reading a specific person's tweets and podcasts from the past 30 days before a meeting; be mindful of privacy when researching specific individuals
- SKILL.md requires Python 3.12 or higher; briefings are saved by default to ~/Documents/Last30Days; SKILL.md is approximately 30,000 bytes, and over a dozen reference files are read depending on the situation, resulting in a long workflow with many calls, leading to high time and credit consumption