技能 last30days
📦

last30days

内容修订 r1 高风险 🌐 网络访问📁 文件系统访问🔑 环境变量⚡ 包含脚本⚙️ 外部命令

研究当前社区趋势

快速变化的话题很难仅凭记忆进行研究。此技能会收集近期 Reddit、X 和网页信号,然后将其转化为实用指导。

支持: Claude Codex Code(CC)
⚠️ 38 差

使用我的智能体安装

将此请求复制给你的智能体,其中包含权威 Skill 页面和清单。

智能体请求
Review the Skillstore skill "last30days" from https://skillstore.io/skills/sickn33-last30days.md and its manifest at https://skillstore.io/api/skills/sickn33-last30days/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划,并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文,而不是读取完整页面时,请使用这些链接。

测试它

正在使用“last30days”。 /last30days best Claude Code skills

预期结果:

对被提及的技能、市场和资源进行排名摘要,并包含来源类型和互动备注。

正在使用“last30days”。 /last30days iOS app mockups for Nano Banana Pro

预期结果:

综合当前 UI 提示词模式,然后为目标图像工具提供定制的提示词格式。

正在使用“last30days”。 /last30days what are people saying about DeepSeek R1

预期结果:

近期情绪摘要,包含正面主题、顾虑以及最强烈的反复讨论点。

安全审计

高风险
v5 • 2026/7/9 打开版本化报告

Confirmed runtime network calls to OpenAI, xAI, and Reddit, plus API-key handling, hidden configuration loading, and local report/cache writes. Most markdown, plan, test, and fixture hits are false positives, but one packaged photo contains GPS EXIF metadata. No evidence found of prompt-injection text that tries to bypass security review.

36
已扫描文件
7,069
分析行数
66
复核项
0
已忽略误报

已确认安全问题 (4)

高
Environment file access
CONFIG_FILE = CONFIG_DIR / ".env"
The environment helper defines and loads ~/.config/last30days/.env. This is legitimate configuration loading, but it reads a hidden file that may contain API keys.
高
Environment file access
"""Load configuration from ~/.config/last30days/.env and environment."""
The environment helper defines and loads ~/.config/last30days/.env. This is legitimate configuration loading, but it reads a hidden file that may contain API keys.
高
Environment file access
cat > ~/.config/last30days/.env << 'ENVEOF'
The setup instructions solicit OpenAI or xAI API keys for storage in ~/.config/last30days/.env. Legitimate optional setup still handles sensitive credentials.
高
Environment file access
chmod 600 ~/.config/last30days/.env
The setup instructions solicit OpenAI or xAI API keys for storage in ~/.config/last30days/.env. Legitimate optional setup still handles sensitive credentials.
能力复核项 (66)

这些是真实的本地能力,对此技能可能是预期行为,因此需要复核,但不会按已确认恶意行为计分。

高
Generic API/secret keys
config["OPENAI_API_KEY"],
The main pipeline passes configured API keys into OpenAI or xAI search clients for outbound requests. This is intended behavior, but it handles user secrets.
高
Generic API/secret keys
config["OPENAI_API_KEY"],
The main pipeline passes configured API keys into OpenAI or xAI search clients for outbound requests. This is intended behavior, but it handles user secrets.
高
Generic API/secret keys
config["XAI_API_KEY"],
The main pipeline passes configured API keys into OpenAI or xAI search clients for outbound requests. This is intended behavior, but it handles user secrets.
高
Hidden file in home directory
"""Load configuration from ~/.config/last30days/.env and environment."""
The environment helper defines and loads ~/.config/last30days/.env. This is legitimate configuration loading, but it reads a hidden file that may contain API keys.
高
Generic API/secret keys
'OPENAI_API_KEY': os.environ.get('OPENAI_API_KEY') or file_env.get('OPENAI_API_KEY'),
The code reads OPENAI_API_KEY or XAI_API_KEY from process environment or the .env file. These are sensitive credentials used by provider clients.
高
Generic API/secret keys
'XAI_API_KEY': os.environ.get('XAI_API_KEY') or file_env.get('XAI_API_KEY'),
The code reads OPENAI_API_KEY or XAI_API_KEY from process environment or the .env file. These are sensitive credentials used by provider clients.
高
Generic API/secret keys
has_openai = bool(config.get('OPENAI_API_KEY'))
The code checks whether OpenAI or xAI keys are present to select active sources. This is intentional, but it is real credential-aware behavior.
高
Generic API/secret keys
has_xai = bool(config.get('XAI_API_KEY'))
The code checks whether OpenAI or xAI keys are present to select active sources. This is intentional, but it is real credential-aware behavior.
高
Generic API/secret keys
has_openai = bool(config.get('OPENAI_API_KEY'))
The code checks whether OpenAI or xAI keys are present to select active sources. This is intentional, but it is real credential-aware behavior.
高
Generic API/secret keys
has_xai = bool(config.get('XAI_API_KEY'))
The code checks whether OpenAI or xAI keys are present to select active sources. This is intentional, but it is real credential-aware behavior.
高
Generic API/secret keys
headers = {"Authorization": f"Bearer {api_key}"}
The model selector checks configured API keys and uses an Authorization header for provider model discovery. This is legitimate but handles sensitive credentials.
高
Generic API/secret keys
if config.get("OPENAI_API_KEY"):
The model selector checks configured API keys and uses an Authorization header for provider model discovery. This is legitimate but handles sensitive credentials.
高
Generic API/secret keys
config["OPENAI_API_KEY"],
The model selector checks configured API keys and uses an Authorization header for provider model discovery. This is legitimate but handles sensitive credentials.
高
Generic API/secret keys
if config.get("XAI_API_KEY"):
The model selector checks configured API keys and uses an Authorization header for provider model discovery. This is legitimate but handles sensitive credentials.
高
Generic API/secret keys
config["XAI_API_KEY"],
The model selector checks configured API keys and uses an Authorization header for provider model discovery. This is legitimate but handles sensitive credentials.
高
Generic API/secret keys
"Authorization": f"Bearer {api_key}",
The OpenAI client places the API key in an Authorization bearer header. This is necessary for the feature but is real secret transmission to an external API.
高
Generic API/secret keys
"Authorization": f"Bearer {api_key}",
The xAI client places the API key in an Authorization bearer header. This is necessary for the feature but is real secret transmission to an external API.
高
Hidden file in home directory
mkdir -p ~/.config/last30days
The skill instructions explicitly create or use hidden paths under ~/.config or ~/.claude during setup and execution. This is user-directed but still a real filesystem side effect.
高
Hidden file in home directory
cat > ~/.config/last30days/.env << 'ENVEOF'
The skill instructions explicitly create or use hidden paths under ~/.config or ~/.claude during setup and execution. This is user-directed but still a real filesystem side effect.
高
Hidden file in home directory
chmod 600 ~/.config/last30days/.env
The skill instructions explicitly create or use hidden paths under ~/.config or ~/.claude during setup and execution. This is user-directed but still a real filesystem side effect.
高
Hidden file in home directory
python3 ~/.claude/skills/last30days/scripts/last30days.py "$ARGUMENTS" --emit=compact 2>&1
The skill instructions explicitly create or use hidden paths under ~/.config or ~/.claude during setup and execution. This is user-directed but still a real filesystem side effect.
高
Generic API/secret keys
OPENAI_API_KEY=
The setup instructions solicit OpenAI or xAI API keys for storage in ~/.config/last30days/.env. Legitimate optional setup still handles sensitive credentials.
高
Generic API/secret keys
XAI_API_KEY=
The setup instructions solicit OpenAI or xAI API keys for storage in ~/.config/last30days/.env. Legitimate optional setup still handles sensitive credentials.
中
Python file write/append
with open(cache_path, 'w') as f:
The cache helper writes JSON files under the user cache directory. The path is controlled by the application, but it persists user research data locally.
中
Python file write/append
with open(MODEL_CACHE_FILE, 'w') as f:
The cache helper writes JSON files under the user cache directory. The path is controlled by the application, but it persists user research data locally.
中
Hidden file access
"""Load configuration from ~/.config/last30days/.env and environment."""
The environment helper defines and loads ~/.config/last30days/.env. This is legitimate configuration loading, but it reads a hidden file that may contain API keys.
中
Python file write/append
with open(OUTPUT_DIR / "report.json", 'w') as f:
The renderer writes reports, context files, and raw provider responses under ~/.local/share/last30days/out. This persists user research output and raw API data locally.
中
Python file write/append
with open(OUTPUT_DIR / "report.md", 'w') as f:
The renderer writes reports, context files, and raw provider responses under ~/.local/share/last30days/out. This persists user research output and raw API data locally.
中
Python file write/append
with open(OUTPUT_DIR / "last30days.context.md", 'w') as f:
The renderer writes reports, context files, and raw provider responses under ~/.local/share/last30days/out. This persists user research output and raw API data locally.
中
Python file write/append
with open(OUTPUT_DIR / "raw_openai.json", 'w') as f:
The renderer writes reports, context files, and raw provider responses under ~/.local/share/last30days/out. This persists user research output and raw API data locally.
中
Python file write/append
with open(OUTPUT_DIR / "raw_xai.json", 'w') as f:
The renderer writes reports, context files, and raw provider responses under ~/.local/share/last30days/out. This persists user research output and raw API data locally.
中
Python file write/append
with open(OUTPUT_DIR / "raw_reddit_threads_enriched.json", 'w') as f:
The renderer writes reports, context files, and raw provider responses under ~/.local/share/last30days/out. This persists user research output and raw API data locally.
中
Hidden file access
mkdir -p ~/.config/last30days
The skill instructions explicitly create or use hidden paths under ~/.config or ~/.claude during setup and execution. This is user-directed but still a real filesystem side effect.
中
Hidden file access
cat > ~/.config/last30days/.env << 'ENVEOF'
The skill instructions explicitly create or use hidden paths under ~/.config or ~/.claude during setup and execution. This is user-directed but still a real filesystem side effect.
中
Hidden file access
chmod 600 ~/.config/last30days/.env
The skill instructions explicitly create or use hidden paths under ~/.config or ~/.claude during setup and execution. This is user-directed but still a real filesystem side effect.
中
Hidden file access
python3 ~/.claude/skills/last30days/scripts/last30days.py "$ARGUMENTS" --emit=compact 2>&1
The skill instructions explicitly create or use hidden paths under ~/.config or ~/.claude during setup and execution. This is user-directed but still a real filesystem side effect.
低
Python environment access
os.environ["LAST30DAYS_DEBUG"] = "1"
The --debug option mutates LAST30DAYS_DEBUG in the process environment to increase logging. It is intentional and low impact, but it is real environment manipulation.
低
Python environment access
'OPENAI_API_KEY': os.environ.get('OPENAI_API_KEY') or file_env.get('OPENAI_API_KEY'),
The code reads OPENAI_API_KEY or XAI_API_KEY from process environment or the .env file. These are sensitive credentials used by provider clients.
低
Python environment access
'XAI_API_KEY': os.environ.get('XAI_API_KEY') or file_env.get('XAI_API_KEY'),
The code reads OPENAI_API_KEY or XAI_API_KEY from process environment or the .env file. These are sensitive credentials used by provider clients.
低
Python environment access
'OPENAI_MODEL_POLICY': os.environ.get('OPENAI_MODEL_POLICY') or file_env.get('OPENAI_MODEL_POLICY',
The code reads model policy configuration from the environment or .env file. This is low-severity configuration access that can alter provider behavior.
低
Python environment access
'OPENAI_MODEL_PIN': os.environ.get('OPENAI_MODEL_PIN') or file_env.get('OPENAI_MODEL_PIN'),
The code reads model policy configuration from the environment or .env file. This is low-severity configuration access that can alter provider behavior.
低
Python environment access
'XAI_MODEL_POLICY': os.environ.get('XAI_MODEL_POLICY') or file_env.get('XAI_MODEL_POLICY', 'latest')
The code reads model policy configuration from the environment or .env file. This is low-severity configuration access that can alter provider behavior.
低
Python environment access
'XAI_MODEL_PIN': os.environ.get('XAI_MODEL_PIN') or file_env.get('XAI_MODEL_PIN'),
The code reads model policy configuration from the environment or .env file. This is low-severity configuration access that can alter provider behavior.
低
Configuration library
has_openai = bool(config.get('OPENAI_API_KEY'))
The code checks whether OpenAI or xAI keys are present to select active sources. This is intentional, but it is real credential-aware behavior.
低
Configuration library
has_xai = bool(config.get('XAI_API_KEY'))
The code checks whether OpenAI or xAI keys are present to select active sources. This is intentional, but it is real credential-aware behavior.
低
Configuration library
has_openai = bool(config.get('OPENAI_API_KEY'))
The code checks whether OpenAI or xAI keys are present to select active sources. This is intentional, but it is real credential-aware behavior.
低
Configuration library
has_xai = bool(config.get('XAI_API_KEY'))
The code checks whether OpenAI or xAI keys are present to select active sources. This is intentional, but it is real credential-aware behavior.
低
HTTP client library
def request(
The HTTP helper imports urllib, constructs requests, and opens URLs including Reddit JSON endpoints. This is intentional outbound network access.
低
HTTP client library
return request("GET", url, headers=headers, **kwargs)
The HTTP helper imports urllib, constructs requests, and opens URLs including Reddit JSON endpoints. This is intentional outbound network access.
低
HTTP client library
return request("POST", url, headers=headers, json_data=json_data, **kwargs)
The HTTP helper imports urllib, constructs requests, and opens URLs including Reddit JSON endpoints. This is intentional outbound network access.
低
Python HTTP libraries
import urllib.request
The HTTP helper imports urllib, constructs requests, and opens URLs including Reddit JSON endpoints. This is intentional outbound network access.
低
Python HTTP libraries
req = urllib.request.Request(url, data=data, headers=headers, method=method)
The HTTP helper imports urllib, constructs requests, and opens URLs including Reddit JSON endpoints. This is intentional outbound network access.
低
Python HTTP libraries
with urllib.request.urlopen(req, timeout=timeout) as response:
The HTTP helper imports urllib, constructs requests, and opens URLs including Reddit JSON endpoints. This is intentional outbound network access.
低
Hardcoded URL
url = f"https://www.reddit.com{path}?raw_json=1"
The HTTP helper imports urllib, constructs requests, and opens URLs including Reddit JSON endpoints. This is intentional outbound network access.
低
Python environment access
DEBUG = os.environ.get("LAST30DAYS_DEBUG", "").lower() in ("1", "true", "yes")
The module reads LAST30DAYS_DEBUG from the environment to enable diagnostic logging. This is real but low-severity environment-controlled behavior.
低
HTTP/HTTPS get
response = http.get(OPENAI_MODELS_URL, headers=headers)
The model selector uses the OpenAI models endpoint through the shared HTTP client. This is intentional outbound provider communication.
低
Hardcoded URL
OPENAI_MODELS_URL = "https://api.openai.com/v1/models"
The model selector uses the OpenAI models endpoint through the shared HTTP client. This is intentional outbound provider communication.
低
Configuration library
if config.get("OPENAI_API_KEY"):
The model selector checks configured API keys and uses an Authorization header for provider model discovery. This is legitimate but handles sensitive credentials.
低
Configuration library
config.get("OPENAI_MODEL_POLICY", "auto"),
The model selector checks configured API keys and uses an Authorization header for provider model discovery. This is legitimate but handles sensitive credentials.
低
Configuration library
config.get("OPENAI_MODEL_PIN"),
The model selector checks configured API keys and uses an Authorization header for provider model discovery. This is legitimate but handles sensitive credentials.
低
Configuration library
if config.get("XAI_API_KEY"):
The model selector checks configured API keys and uses an Authorization header for provider model discovery. This is legitimate but handles sensitive credentials.
低
Configuration library
config.get("XAI_MODEL_POLICY", "latest"),
The model selector checks configured API keys and uses an Authorization header for provider model discovery. This is legitimate but handles sensitive credentials.
低
Configuration library
config.get("XAI_MODEL_PIN"),
The model selector checks configured API keys and uses an Authorization header for provider model discovery. This is legitimate but handles sensitive credentials.
低
Hardcoded URL
OPENAI_RESPONSES_URL = "https://api.openai.com/v1/responses"
The OpenAI Responses endpoint is the active destination for Reddit discovery. The skill intentionally makes authenticated external API calls.
低
HTTP/HTTPS get
data = http.get_reddit_json(path)
The Reddit enrichment flow calls http.get_reddit_json for fetched thread URLs. This is intended outbound network access to reddit.com.
低
Hardcoded URL
XAI_RESPONSES_URL = "https://api.x.ai/v1/responses"
The xAI Responses endpoint is the active destination for X search. The skill intentionally makes authenticated external API calls.

风险因素

🌐 网络访问 (31)
📁 文件系统访问 (50)
🔑 环境变量 (50)
⚡ 包含脚本 (1)
⚙️ 外部命令 (43)
审计者: codex 查看审计历史 →
分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据,不判断该 Skill 是否安全。

打开版本化报告
安全评估

复制报告链接

https://skillstore.io/skills/sickn33-last30days/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-last30days/security.svg)](https://skillstore.io/skills/sickn33-last30days?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/sickn33-last30days?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-last30days/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/sickn33-last30days.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学术引用 (APA · BibTeX · CFF)

APA 引用

sickn33. (2026). last30days security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-last30days/audits/5

BibTeX 引用

@techreport{sickn33-sickn33-last30days-2026, author = {sickn33}, title = {last30days security audit report (audit version 5)}, institution = {Skillstore}, year = {2026}, number = {5}, url = {https://skillstore.io/skills/sickn33-last30days/audits/5}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "last30days security audit report (audit version 5)" version: "unspecified" type: report authors: - name: "sickn33" date-released: "2026-07-09" url: "https://skillstore.io/skills/sickn33-last30days/audits/5" identifiers: - type: other value: "skillstore:sickn33-last30days:audit:5" description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据 证据置信度: 中
73
架构
85
可维护性
85
内容
69
社区
83
规范符合性

你能构建什么

查找当前提示词模式

在为图像、音乐、编码或写作工具编写提示词之前,研究近期示例和社区建议。

跟踪产品情绪

比较过去一个月中 Reddit、X 和网页上对某个工具、发布或趋势的看法。

构建推荐列表

识别被频繁提及的工具、技能、资源或产品,并提供相应的互动信号支持。

试试这些提示

基础近期研究
/last30days {topic}
针对某个工具的提示词
/last30days {topic} prompts for {target tool}
推荐扫描
/last30days best {tool category or product type}
深度综合请求
/last30days {topic} for {target tool} --deep

最佳实践

  • 使用准确的主题名称,避免搜索偏向旧主题或相关但不同的主题。
  • 仅在 Reddit 或 X 互动指标很重要时添加 API 密钥。
  • 在处理敏感、法律、金融或医疗主题之前,先审查原始来源。

避免

  • 不要将仅网页输出视为等同于完整的 Reddit 和 X 覆盖。
  • 不要在未运行新查询的情况下,将旧研究复用于不同主题。
  • 不要将私密数据粘贴到研究主题或生成的提示词中。

常见问题

此技能在没有 API 密钥的情况下能工作吗?
可以。它会回退到网页搜索,但 Reddit 和 X 互动指标不可用。
它可以搜索哪些服务?
它可以通过 OpenAI 使用 Reddit,通过 xAI 使用 X,并使用助手的网页搜索工具。
它将输出存储在哪里?
它会将报告、上下文文件和原始响应写入本地 last30days 输出目录。
它可以为非编码工具创建提示词吗?
可以。示例包括图像生成、音乐生成、产品研究和通用趋势分析。
结果有多新?
该流程面向过去 30 天,并在日期信号可用时筛选带日期的项目。
它适合机密研究吗?
请谨慎使用。当启用由 API 支持的 Reddit 或 X 搜索时,主题可能会被发送给外部提供商。

开发者详情

作者

sickn33

许可证

MIT

Skillstore 修订

r1

版本提示

作者未声明版本。

引用

3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88

维护新鲜度

2026/7/18

使用量

41 次下载 · 159 次浏览