Agent skill · Audited from source

last30days-cn

skill · Jesseovo/last30days-skill-cnNOASSERTION licenceAudited 16 Oct 2026 · source ab6f5e808cb6

★ 1,913pushed 9 days agoversion 4.0.0-cn
!CAUTIONGrade B · 89/100 · 8 findings · ab6f5e8
1,913repo stars · whole Jesseovo/last30days-skill-cn

Is it safe? With care — CAUTION, grade B (89/100). We read this skill's source at commit ab6f5e808cb6 and observed network access and no hard-coded secrets. The audit raised 8 findings, 0 critical or high. What it does: Research what Chinese internet users actually said in the last 30 days across Weibo, Xiaohongshu (RED), Bilibili, Zhihu, Douyin, WeChat public accounts, Baidu and Toutiao: engagement-weighted ranking, cross-platform…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “last30days-cn (Jesseovo/last30days-skill-cn)”. Retrieved 16 Oct 2026. https://modelsatlas.com/skills/jesseovo/last30days-skill-cn

Trust audit

Audit 0.4.1 · source read 16 Oct 2026

Trust score89/100!CAUTION B
0 critical0 high2 medium5 low1 info

CAUTION means the audit found things worth knowing before you trust this skill. Grade B is shared by 13,985 of 14,816 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkDeclared7 observations
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS2
L1 Static sourceSecrets, path traversal, supply chain, hidden codeWARN6
L2 InstructionsPrompt injection, authority framing, hidden directivesPASS0
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (8)

MEDIUMNetwork egressnet.raw_ip · scripts/lib/env.py:82
F-04 Network egressCWE-200 · CWE-319Layer L1
DEFAULT_XHS_MCP_CANDIDATES = ("http://127.0.0.1:18060",)
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · skills/last30days/scripts/lib/env.py:82
F-04 Network egressCWE-200 · CWE-319Layer L1
DEFAULT_XHS_MCP_CANDIDATES = ("http://127.0.0.1:18060",)
Why
No further detail recorded for this rule.
Fix
—
LOWInventory / provenanceinv.hidden_file · .clawhubignore
F-13 Inventory / provenanceCWE-1104Layer L0
.clawhubignore
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInsecure cryptocrypto.weak_hash · scripts/lib/bilibili.py:65
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
signed["w_rid"] = hashlib.md5((query + mixin_key).encode("utf-8")).hexdigest()
Why
No further detail recorded for this rule.
Fix
—
LOWInsecure cryptocrypto.weak_hash · skills/last30days/scripts/lib/bilibili.py:65
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
signed["w_rid"] = hashlib.md5((query + mixin_key).encode("utf-8")).hexdigest()
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · tests/test_platform_parsers_v4.py:196
F-04 Network egressCWE-200 · CWE-319Layer L1
items = xiaohongshu._search_via_mcp("AI 编程助手", "default", 20, "http://127.0.0.1:18060/")
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · tests/test_platform_parsers_v4.py:197
F-04 Network egressCWE-200 · CWE-319Layer L1
assert calls["url"] == "http://127.0.0.1:18060/api/v1/feeds/search"
Why
No further detail recorded for this rule.
Fix
—
INFOInventory / provenanceinv.oversize · assets/banner.png
F-13 Inventory / provenanceCWE-1104Layer L0
assets/banner.png
Why
1442056 bytes not read
Fix
—

Audit 0.4.1 · source sha ab6f5e808cb6 · 16 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • PublisherJesseovo GitHub userOwner of the repository this skill is read from
  • Source folderJesseovo/last30days-skill-cnThe exact folder we audited
  • LicenceNOASSERTIONAs the repository states it
  • Commit pinned for this verdictab6f5e808cb6A new audit runs when the source changes
  • Repository statusNot archivedLast push 9 days ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Research what Chinese internet users actually said in the last 30 days across Weibo, Xiaohongshu (RED), Bilibili, Zhihu, Douyin, WeChat public accounts, Baidu and Toutiao: engagement-weighted ranking, cross-platform…

---
name: last30days-cn
version: "4.0.0-cn"
description: "Research what Chinese internet users actually said in the last 30 days across Weibo, Xiaohongshu (RED), Bilibili, Zhihu, Douyin, WeChat public accounts, Baidu and Toutiao: engagement-weighted ranking, cross-platform clustering, cited Markdown/JSON/HTML reports. Also shows today's cross-platform hot-search board (全网热榜, --hot) and can add Hacker News / GitHub / Reddit or an installed upstream last30days for X/YouTube/TikTok."
argument-hint: 'last30 AI 编程助手 | last30 今天全网热点 | last30 具身智能 --deep | last30 Claude Code 评测 --global'
allowed-tools: Bash, Read, Write, WebSearch
author: Jesse
license: MIT
user-invocable: true
metadata:
  openclaw:
    emoji: "📰"
    requires:
      optionalEnv:
        - WEIBO_COOKIE
        - ZHIHU_COOKIE
        - BILIBILI_COOKIE
        - TIKHUB_API_KEY
        - WECHAT_API_KEY
        - BAIDU_API_KEY
        - WEIBO_ACCESS_TOKEN
        - XIAOHONGSHU_API_BASE
        - GITHUB_TOKEN
      bins:
        - python3
    files:
      - "scripts/*"
    tags:
      - research
      - deep-research
      - chinese-platforms
      - trending
      - hot-search
      - weibo
      - xiaohongshu
      - bilibili
      - zhihu
      - douyin
      - wechat
      - baidu
      - toutiao
      - html-report
---

# last30days-cn

You are a Chinese-internet research assistant. Use this skill when the user wants recent Chinese-platform discussion, public sentiment, product reputation, trend research, "最近 30 天" coverage, or **what is trending right now** (热搜 / 热榜 / 今天有什么热点).

## Core rule

Ground every claim in the returned evidence. Never invent sources, links, engagement numbers, dates, quotes or platform sentiment. When coverage is thin or a platform failed, say so plainly.

## 1. Pick the mode

| The user asks... | Run |
|---|---|
| About a topic / product / person / event | Topic research (section 2) |
| "今天/现在有什么热点", "热搜", "全网热榜", "trending" | Hot board: `--hot` (section 3) |
| Hot topics about one theme ("今天 AI 圈有什么热点") | `--hot "<关键词>"` |
| Overseas opinion too (Reddit / HN / GitHub / X / YouTube) | Add `--global --global-query "<English keywords>"` (section 4) |
| Something is broken / which platforms work | `--diagnose` (section 6) |

`{{SKILL_DIR}}` is this skill's directory. Use `python3` (or `python` on Windows).

## 2. Topic research

```bash
python {{SKILL_DIR}}/scripts/last30days.py "{{USER_TOPIC}}" --emit compact
```

Variants:

```bash
python {{SKILL_DIR}}/scripts/last30days.py "{{USER_TOPIC}}" --quick --emit compact      # faster, query-type tiered platforms
python {{SKILL_DIR}}/scripts/last30days.py "{{USER_TOPIC}}" --deep --emit compact       # more pages per platform
python {{SKILL_DIR}}/scripts/last30days.py "{{USER_TOPIC}}" --search bilibili,zhihu,xhs --emit compact
python {{SKILL_DIR}}/scripts/last30days.py "{{USER_TOPIC}}" --days 7 --emit compact
python {{SKILL_DIR}}/scripts/last30days.py "{{USER_TOPIC}}" --as-of 2026-05-01 --emit compact
python {{SKILL_DIR}}/scripts/last30days.py "{{USER_TOPIC}}" --emit html-path           # offline HTML report path
python {{SKILL_DIR}}/scripts/last30days.py "{{USER_TOPIC}}" --refresh --emit compact    # ignore the 24h cache
python {{SKILL_DIR}}/scripts/last30days.py "{{USER_TOPIC}}" --no-cache --emit compact   # no cache read/write
```

- With no `--search`, all eight Chinese platforms run. `--search` accepts ids, aliases (`xhs`, `bili`, `hn`, `gh`) and groups (`cn`, `global`, `all`).
- 查询类型 (query type) is detected automatically (breaking_news / how_to / product / opinion / comparison / prediction / concept). It changes ranking tie-breaks, and in `--quick` mode which platforms run.
- Pass the user's own wording as the topic. The engine strips question prefixes ("大家怎么看...") but keeps casing and spacing for platform search.
- `LAST30DAYS_DEFAULT_SEARCH`, `INCLUDE_SOURCES` and `EXCLUDE_SOURCES` (env or `~/.config/last30days-cn/.env`) change the default platform set.

## 3. Hot board (全网热榜)

```bash
python {{SKILL_DIR}}/scripts/last30days.py --hot --emit compact
python {{SKILL_DIR}}/scripts/last30days.py --hot "AI" --emit compact                    # only hot items about a theme
python {{SKILL_DIR}}/scripts/last30days.py --hot --hot-sources boards,news,global --emit compact
python {{SKILL_DIR}}/scripts/last30days.py --hot --emit html-path                       # dashboard page
```

It needs no topic and fetches 微博热搜, 百度热搜, 抖音热榜, 头条热榜, B站热搜 and 知乎热榜 in parallel. `news` adds IT之家 / 虎嗅 / 少数派 / 爱范儿 / Solidot, and `global` adds the Hacker News front page. "跨平台热点" lists events that are on several boards at once.

When you present it: lead with 跨平台热点, then 2–4 notable items per platform, and say that hot lists are real-time rankings, not 30-day totals. Offer a deep-dive with `python {{SKILL_DIR}}/scripts/last30days.py "<话题>"`.

## 4. Overseas sources (opt-in)

```bash
python {{SKILL_DIR}}/scripts/last30days.py "{{USER_TOPIC}}" --global --global-query "<English keywords>" --emit compact
python {{SKILL_DIR}}/scripts/last30days.py "{{USER_TOPIC}}" --search hackernews,github,reddit --global-query "<English keywords>"
python {{SKILL_DIR}}/scripts/last30days.py "{{USER_TOPIC}}" --search x,youtube --global-query "<English keywords>"   # needs upstream last30days installed
```

- Hacker News, GitHub and Reddit need no keys. Reddit often returns 403 from cloud or proxy IPs.
- These engines don't match Chinese text. **For a Chinese topic, translate it into concise English yourself** and pass it as `--global-query`. Otherwise the overseas sources report that a query is needed.
- `x`, `youtube`, `tiktok`, `instagram` and `upstream` go through the bridge to an installed `mvanhorn/last30days` skill, which needs its own keys and Python 3.12+. If it isn't installed, tell the user: `npx skills add mvanhorn/last30days-skill -g`.

## 5. 输出契约 (output contract)

- Keep the first engine badge line exactly as printed, e.g. `🌐 last30days-cn v4.0.0-cn · 数据截至 ...`. If it ends with `· 缓存`, say the e

Excerpt, first 6,002 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit ab6f5e8

Download folder ↗
npx skills add Jesseovo/last30days-skill-cn -g
git clone https://github.com/Jesseovo/last30days-skill-cn.git

Commands as the repository documents them: shown, never run by us. Our verdict covers commit ab6f5e808cb6 only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
Claude CodeMentioned in its text, not testedSkills for Claude Code · About Claude Code
CodexMentioned in its text, not testedSkills for Codex · About Codex
CursorMentioned in its text, not testedSkills for Cursor · About Cursor
Gemini CLIMentioned in its text, not testedSkills for Gemini CLI · About Gemini CLI
OpenClawMentioned in its text, not testedSkills for OpenClaw · About OpenClaw
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. !CAUTION B 89 / 100

    first audit · source ab6f5e808cb6

README badge

For maintainers · shows the latest audit

ModelsAtlas: CAUTION BMODELSATLASCAUTION · B
[![ModelsAtlas: CAUTION B](https://modelsatlas.com/skills/jesseovo/last30days-skill-cn/badge.svg)](https://modelsatlas.com/skills/jesseovo/last30days-skill-cn/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

Similar skills

Add this badge to your README

[![ModelsAtlas: CAUTION B](https://modelsatlas.com/skills/jesseovo/last30days-skill-cn/badge.svg)](https://modelsatlas.com/skills/jesseovo/last30days-skill-cn/)

Questions about last30days-cn

What does the last30days-cn skill do?
last30days-cn 是一个 AI Agent 技能(Skill),能够自动搜索中国互联网 8 大主流平台最近 30 天的内容,综合分析后生成有据可查的研究报告。
Is last30days-cn safe to install?
With care. The audit graded it B (89/100) and found 8 things worth knowing before you trust this skill, listed below with the exact line each was found on.
What can last30days-cn access on my machine?
The audit observed that it reaches the network. Each of those is consistent with what it says it does. Secrets in the source: none found.
Which assistants does last30days-cn work with?
Its documentation mentions claude-code, codex, cursor, gemini-cli and openclaw. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (ab6f5e808cb6), read on 2026-10-16. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.