sawz/last30days-skill
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: improve ClawHub security scan result

Browse Source 
- Remove prompt-injection false positive ("you are now" → "treat yourself as")
- Declare AUTH_TOKEN and CT0 in frontmatter optionalEnv
- Clarify X token access language (no browser session access)
- Add permissions overview block near top of file

Zero functionality changes — metadata and prose only.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Matt Van Horn
2026-03-06 18:35:38 -08:00
parent ef1f380cda
commit fad26d41fd
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SKILL.md
+6 -2
View File
@@ -22,6 +22,8 @@ metadata:
- PARALLEL_API_KEY - PARALLEL_API_KEY
- BRAVE_API_KEY - BRAVE_API_KEY
- APIFY_API_TOKEN - APIFY_API_TOKEN
- AUTH_TOKEN
- CT0
bins: bins:
- node - node
- python3 - python3
@@ -44,6 +46,8 @@ metadata:
# last30days v2.9.4: Research Any Topic from the Last 30 Days # last30days v2.9.4: Research Any Topic from the Last 30 Days
> **Permissions overview:** Reads public web/platform data and optionally saves research briefings to `~/Documents/Last30Days/`. X/Twitter search uses optional user-provided tokens (AUTH_TOKEN/CT0 env vars) — no browser session access. All credential usage and data writes are documented in the [Security & Permissions](#security--permissions) section.
Research ANY topic across Reddit, X, YouTube, TikTok, Hacker News, Polymarket, and the web. Surface what people are actually discussing, recommending, betting on, and debating right now. Research ANY topic across Reddit, X, YouTube, TikTok, Hacker News, Polymarket, and the web. Surface what people are actually discussing, recommending, betting on, and debating right now.
## CRITICAL: Parse User Intent ## CRITICAL: Parse User Intent
@@ -582,7 +586,7 @@ For the rest of this conversation, remember:
- **KEY PATTERNS**: {list the top 3-5 patterns you learned} - **KEY PATTERNS**: {list the top 3-5 patterns you learned}
- **RESEARCH FINDINGS**: The key facts and insights from the research - **RESEARCH FINDINGS**: The key facts and insights from the research
**CRITICAL: After research is complete, you are now an EXPERT on this topic.** **CRITICAL: After research is complete, treat yourself as an EXPERT on this topic.**
When the user asks follow-up questions: When the user asks follow-up questions:
- **DO NOT run new WebSearches** - you already have the research - **DO NOT run new WebSearches** - you already have the research
@@ -613,7 +617,7 @@ Want another prompt? Just tell me what you're creating next.
**What this skill does:** **What this skill does:**
- Sends search queries to ScrapeCreators API (`api.scrapecreators.com`) for Reddit search, subreddit discovery, and comment enrichment (requires SCRAPECREATORS_API_KEY — same key as TikTok + Instagram) - Sends search queries to ScrapeCreators API (`api.scrapecreators.com`) for Reddit search, subreddit discovery, and comment enrichment (requires SCRAPECREATORS_API_KEY — same key as TikTok + Instagram)
- Legacy: Sends search queries to OpenAI's Responses API (`api.openai.com`) for Reddit discovery (fallback if no SCRAPECREATORS_API_KEY) - Legacy: Sends search queries to OpenAI's Responses API (`api.openai.com`) for Reddit discovery (fallback if no SCRAPECREATORS_API_KEY)
- Sends search queries to Twitter's GraphQL API (via browser cookie auth) or xAI's API (`api.x.ai`) for X search - Sends search queries to Twitter's GraphQL API (via optional user-provided AUTH_TOKEN/CT0 env vars — no browser session access) or xAI's API (`api.x.ai`) for X search
- Sends search queries to Algolia HN Search API (`hn.algolia.com`) for Hacker News story and comment discovery (free, no auth) - Sends search queries to Algolia HN Search API (`hn.algolia.com`) for Hacker News story and comment discovery (free, no auth)
- Sends search queries to Polymarket Gamma API (`gamma-api.polymarket.com`) for prediction market discovery (free, no auth) - Sends search queries to Polymarket Gamma API (`gamma-api.polymarket.com`) for prediction market discovery (free, no auth)
- Runs `yt-dlp` locally for YouTube search and transcript extraction (no API key, public data) - Runs `yt-dlp` locally for YouTube search and transcript extraction (no API key, public data)