last30days: A 60k-Star AI Research Skill, Fact-Checked in the Field

The author spent a week dissecting mvanhorn/last30days-skill, a project with 60k stars marketed as an "AI-agent-driven search engine" that ranks results "by upvotes, likes, and real money." Verdict: both claims are only half true.

What It Actually Is

last30days is a skill (plugin) for Claude Code / Codex / Cursor / Grok. Given a topic, it queries a dozen-plus sources and compiles community discussions with engagement numbers into a brief.

Three Findings From Running It

1. "20 free sources" — actually 5. Out of the box only reddit, hackernews, polymarket, github, and grounding work. Of the other 15, eleven require API keys (including ScrapeCreators, a paid service covering TikTok/Instagram/Threads/Pinterest/LinkedIn/YouTube comments — the skill's own SKILL.md frontmatter lists primaryEnv: SCRAPECREATORS_API_KEY), and four require specific CLI tools. In a test run researching the skill itself, only 3 of 110 Reddit candidates (2.7%) returned real upvote counts.

2. "Ranked by real engagement" — 5% weight. The source-level score uses 65% relevance, 25% freshness, 10% engagement. Cross-source RRF reads only ranks, not values. Final scoring weights:

| Component | Weight | |---|---| | LLM judge (rerank_score) | 60% | | Cross-source rank fusion | 20% | | Freshness | 10% | | Source quality | 5% | | Engagement (real upvotes) | 5% |

By the author's own code comment, a 2.5M-view TikTok and a 1,500-view TikTok end up just 2.4 points apart out of 100 — a 1600x view difference worth almost nothing.

3. The engine has no intelligence of its own. In the test run, the planner LLM, ranking LLM, and comment-judging LLM all failed with 502s — the research still completed. SKILL.md LAW 7 ("YOU ARE THE PLANNER") and LAW 11 ("YOU ARE THE JUDGE") place all intelligence in the host AI. It's a prosthesis, not a brain: a deterministic scraper aggregator with prompt-defined "intelligence."

The 229 KB "Operation Manual"

The SKILL.md is 229 KB — so large the author's own confession states three Opus 4.7 self-debug runs confirmed models start synthesizing before finishing the file. Its step numbering (STEP 0 → 0.45 → 0.5 → 0.55 → 0.75 → STEP 2 → 2.5) shows patches wedged into gaps over time. The word "disaster" appears 10 times, each LAW followed by a real incident record (Peter Steinberger #2, Hermes, Garry Tan — a four-layer defense that still leaked a Sources block). Per the SKILL.md itself (unverified externally): on 2026-04-18, beta validation passed 10/10 while the public version failed 0/8 with near-identical files. Most notable: v3.0.9, "The Self-Debug Release," where the author handed 5 separate Opus 4.7 instances their own failed outputs, and three converged on "SKILL.md is too big and the LAWs are too deep" — diagnoses copy-pasted into code.

Distribution-Chain Problems

Distributed via 8 channels (Claude Code, Grok, OpenClaw, Codex, Cursor, Copilot, Claude.ai, Claude Desktop) — a major source of its 60k stars:

• v3.0.1: a .gitattributes cleanup excluded skills/ and .claude-plugin/, breaking /plugin install with silent failures; four hotfix releases in 22 hours.
• README lags 11 versions (stuck at v3.11.1 vs actual v3.22.0) — in English too, so not just localization debt.
• Issue #1081 (2026-08-30): maintainers themselves opened "Version-labelled builds diverge" — a previously treated and engineering-guarded (v3.3.0 stale-clone check) problem, still recurring.
• The Hermes AI platform's install-time scanner flagged the skill as dangerous with 19 findings, hard-blocking installation (PR #962, 2026-08-08).
• A .skillignore excludes scripts/lib/vendor/ from Hermes scans, commented as "vendored third-party X-search client, still installed" — runtime code bypassing install-time security scanning.
• The hardcoded USER_AGENT = "last30days-skill/3.0 (Assistant Skill)" is stale by many versions.

Legal: Explicit ToS Violation, Not a Gray Area

• X ToS §4(iii): crawling/scraping "without our prior written consent is expressly prohibited," and distributing products that enable violations is also a violation (§5: $15,000 per million posts).
• Reddit robots.txt is Disallow: /; Reddit UA §7 prohibits scraping without written consent.
• LinkedIn §8.2(04) explicitly covers third-party data aggregators — exactly where ScrapeCreators sits.
• Reddit v. SerpApi/Perplexity/Oxylabs (1:25-cv-08736, SDNY): on 2026-07-31 the judge found DMCA §1201(a) anti-circumvention claims valid; this project uses the same cookie-auth + frontend-scraping method.
• grep robots across the entire codebase: 0 hits — no robots.txt compliance logic.
• ScrapeCreators' own ToS pushes 100% compliance liability to the customer, caps compensation at fees paid, and allows termination with forfeiture of balance at any time.

Bottom Line

last30days genuinely solves a real problem — a 268-second run delivered 11 engagement-backed community signals, closer to "what communities actually discuss" than keyword search. But it is not what it claims. Its real knowledge asset isn't 60k stars; it's the 10-disaster list inside SKILL.md. The lesson: LLM reliability comes not from better prompts but from LLMs debugging LLMs, with diagnoses physically moved toward the cache line.

Quick Reference: Claims vs Reality

| Dimension | README Claim | Observed Reality | |---|---|---| | Data sources | 20 sources | 5 work out of the box | | Scoring core | Real engagement | Engagement 5%, LLM rerank 60% | | Reddit real scores | "Free + real scoring" | 3 of 110 candidates scored (2.7%) | | AI judge | Agent-driven | Report completes even when all LLMs 502 | | ToS status | (not mentioned) | Explicit violation (X / Reddit / LinkedIn) | | README version | v3.11.1 | Actual v3.22.0, 11 versions behind | | Security audits | (not in README) | Trust Hub Fail / Snyk Fail / Socket Warn |

Methodology: Firsthand source inspection + full Windows machine run + direct GitHub API queries.