# The 60k-Star Research Skill Is a 2,300-Line Prompt > Source: > Published: 2026-08-30 13:11:41+00:00 [AI](https://sourcefeed.dev/c/ai)Article # The 60k-Star Research Skill Is a 2,300-Line Prompt last30days shows what agent skills become at scale, and why you should read the hooks before installing. [Mariana Souza](https://sourcefeed.dev/u/mariana_souza) Seven months ago Matt Van Horn pushed a Claude Code skill that searched Reddit and X for the last 30 days of chatter on a topic. Today [last30days-skill](https://github.com/mvanhorn/last30days-skill) sits at 60,000 stars, 5,000 forks, version 3.21.1, and a source list that runs from Hacker News to Polymarket to Xiaohongshu. It installs into Claude Code, Codex, Cursor, Gemini CLI, Copilot, Claude Desktop and OpenClaw. It's the most-installed research skill in the wild, which makes it the best case study we have for what that pattern does well and where it strains. The short version: the engine is good, the packaging is the story, and the trust model deserves more scrutiny than a `/plugin install` prompt gives it. ## What it replaces Every coding agent already has a web tool. What none of them reach is the content people actually argue in: Reddit comment threads, X replies, YouTube transcripts, prediction-market odds. Each lives behind its own API and auth, and in X's case an active hostility to third-party reads. last30days is a bring-your-own-keys bridge across all of them. Reddit, HN, [Polymarket](https://polymarket.com), GitHub and StockTwits work with no credentials. YouTube goes through [yt-dlp](https://github.com/yt-dlp/yt-dlp). X goes through your browser's x.com cookies, an xAI API key, or (since 3.19.0) a logged-in Grok CLI with no X account at all. TikTok, Instagram, Threads, Pinterest and LinkedIn go through [ScrapeCreators](https://scrapecreators.com), a paid scraping API with 10,000 free calls. Brave gives you 2,000 web queries a month. Perplexity is pay-as-you-go. The pipeline is where the engineering lives. Before any request fires, the host model resolves the topic into handles, subreddits and repos and writes a query plan to a temp file. The Python engine fans out in parallel, scores each item on engagement, relevance and freshness, merges the same story across platforms into clusters, and hands the ranked evidence back to the model to write the brief. The skill doesn't call an LLM of its own for the write-up; whatever agent you're in does it. A comparison run like "CLI vs MCP" takes about three minutes per the README. This is a batch job, not autocomplete. For a developer the useful bits are the ones that don't involve reading a brief. `--emit=json` gives you a versioned agent profile to pipe into your own tooling. `--store` persists results to SQLite. `scripts/watchlist.py` runs scheduled topics and posts to Slack or a webhook; `scripts/briefing.py` rolls them into digests. If you've been hand-rolling a "what are people saying about our library" cron job out of Reddit RSS and a search API, this replaces it, and the cross-source clustering is the part nobody bothers to write themselves. ## The SKILL.md is 2,300 lines long Here is the part I'd put in front of anyone building agent skills. The [Agent Skills spec](https://agentskills.io/specification) recommends keeping `SKILL.md` under 500 lines and roughly 5,000 tokens, with everything else pushed into `references/` files loaded on demand. last30days' runtime spec is 2,296 lines and about 33,700 words. By the usual words-to-tokens rule of thumb, that's somewhere around 45,000 tokens injected into context every time you type `/last30days` , before a single search runs. Read it and you understand why. The file is not documentation. It's a runbook written against the model. It opens with a "stale-clone self-check" because Claude Code's marketplace directory can lag the versioned plugin cache. It then declares a "SKILL CONTRACT" with numbered LAWs, each annotated with a dated failure: an April 2026 regression where Opus 4.7 ignored the contract on eight of eight public runs and improvised its own headers; a June run where the model skipped the setup wizard because a branching rule named the wrong next step; a case where the model misread a "no LLM provider" warning as a missing credential, when the model itself is the provider. This is prompt engineering practiced as bug tracking, and it's the most candid record I've seen of what skills cost in practice. The Python side is deterministic, has 2,700 tests, and behaves. The prose side is a control layer over a stochastic executor, and every model release can silently change how it's read. The maintainers' answer has been more prose: more laws, more named regressions, a mandatory first-line version badge so users can tell whether the contract loaded at all. It works, going by the release cadence. It also means the skill's real dependency isn't Python 3.12; it's the reading behavior of whichever frontier model you run it in. If you're writing your own skill, take the lesson the other way. Push logic into scripts with explicit flags and structured output, keep the prose to routing, and treat every instruction the model must obey as something you'll re-validate on each model bump. ## Read the trust model before you install it A skill that only shells out to `curl` is one thing. last30days ships a `SessionStart` hook that runs on every Claude Code session, whether or not you invoke the skill, and code that decrypts cookies from Chrome, Brave, Edge, Arc, Firefox and Safari via the macOS Keychain. A coordinated disclosure filed as issue #663 on June 23 laid this out: the always-on hook parses your `.env` of API keys; the setup wizard routed GitHub device auth through `api.scrapecreators.com` rather than github.com; the cookie decryption isn't domain-restricted in code, so a prompt injection or supply-chain change could point it at any site's sessions; the wizard runs `npx -y` on an unaudited package; and reranking sends your research topic to OpenAI, xAI or OpenRouter without saying so. The reporter found no exfiltration and no obfuscation. The issue is still open with zero replies as of this writing. Some of it has moved anyway. Release 3.19.0 hardened the hook against command injection via malformed `.env` keys and gated project-level config behind a trust flag; the README credits contributors with locked-down cookie temp files and OpenSSF Scorecard CI. The current hook only checks that keys exist and warns on loose permissions. Whether the OAuth routing and unscoped cookie decryption changed, I couldn't confirm from the changelog. Treat those as open. None of this is unique to this repo. Snyk's ToxicSkills scan of 3,984 skills on ClawHub and skills.sh in February found 36.8% with at least one flaw and 13.4% with a critical one. What's specific here is the install base. A 60,000-star skill that reads browser cookies is exactly what a compromised release would make interesting. I'd still use it, with conditions. Skip the cookie path: pick "xAI API key for X instead" in the wizard or install the Grok CLI, and the Keychain never gets touched. Read `hooks/scripts/check-config.sh` after every update; it's 100-odd lines of bash that run on every session. Don't research anything you'd mind OpenRouter seeing unless you've confirmed reranking is off. And pin a version if your host allows it. ## Where this goes last30days is good at what it does, and letting the host model plan and write while a tested engine fetches is the correct split. The open question is whether skills can stay a lightweight packaging format when the popular ones grow hooks, credential stores, cookie decryptors and 45,000-token contracts. Anthropic's spec was deliberately minimal: a folder, two required frontmatter fields, an experimental `allowed-tools` line. This repo shows what a minimal spec becomes under real demand. Marketplaces will need signing, permission manifests and diff review the way package registries eventually did, and users should act as if they already do. ## Sources & further reading - [mvanhorn/last30days-skill](https://github.com/mvanhorn/last30days-skill)— github.com - [last30days SKILL.md runtime spec (v3.21.1)](https://github.com/mvanhorn/last30days-skill/blob/main/skills/last30days/SKILL.md)— github.com - [Security disclosure: ambient credential-file access, unproxied OAuth token intercept, and unrestricted browser-cookie decryption](https://github.com/mvanhorn/last30days-skill/issues/663)— github.com - [last30days-skill CHANGELOG](https://github.com/mvanhorn/last30days-skill/blob/main/CHANGELOG.md)— github.com - [Agent Skills specification](https://agentskills.io/specification)— agentskills.io - [ToxicSkills: malicious AI agent skills on ClawHub](https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub/)— snyk.io - [Last30Days - AI Agent Review](https://agentconn.com/agents/last30days-skill/)— agentconn.com [Mariana Souza](https://sourcefeed.dev/u/mariana_souza)· Senior Editor Mariana covers the fast-moving world of machine learning and generative AI, with a particular focus on how these technologies are reshaping development workflows. When she isn't stress-testing the latest foundation models, she's usually at a local hackathon. ## Discussion 0 No comments yet Be the first to weigh in.