60k-Star last30days Skill Under the Microscope: Marketing Claims vs. Real-World Test

A hands-on teardown of mvanhorn/last30days-skill, a 60k-star project tagged as an "AI-agent-driven search engine" that ranks results "by upvotes, likes, and real money." After deep source review and a real-machine run, both tags turn out to be half-true.

Key points

• What it is: A skill plugin that runs on Claude Code / Codex / Cursor / Grok. Given a topic, it queries a dozen-plus sources (Reddit, X, YouTube, TikTok, Hacker News, Polymarket, GitHub, etc.) and produces a briefing of community discussions with engagement numbers.
• Only 5 of 20 "free" sources work out of the box: reddit, hackernews, polymarket, github, grounding. The other 15 require API keys (11, including the core ScrapeCreators service covering TikTok/Instagram/Threads/Pinterest/LinkedIn/YouTube comments — a paid service listed as primaryEnv in SKILL.md) or specific CLI tools (4).
• Real engagement data is scarce: In a test run researching the skill itself, only 3 of 110 Reddit candidates returned real upvote counts — a 2.7% hit rate — despite the entire marketing pitch resting on "real engagement."
• Engagement barely affects ranking: The scoring formula weights relevance 65%, freshness 25%, and engagement only 10% at the local level; cross-source RRF fusion reads ranks, not values. Final score weights: LLM judge 60%, cross-source rank fusion 20%, freshness 10%, source quality 5%, engagement 5%. The author's own code comment shows a TikTok video with 1600× more views differs by only ~2.4 points (out of 100) in the final score.
• The engine has no intelligence of its own: When the planner, ranker, and comment-judging LLM calls all failed with 502s, the research still completed. SKILL.md's LAW 7 ("YOU ARE THE PLANNER") and LAW 11 ("YOU ARE THE JUDGE") delegate all intelligence to the host AI. It is "an AI prosthetic, not an AI brain" — a deterministic scraper-aggregator fallback.

The 229 KB SKILL.md

The prompt file is 229 KB — so large that, per the author's own note, "three Opus 4.7 self-debug runs confirmed the model starts synthesizing before reading to the end." Section numbers show patchwork evolution (STEP 0 → 0.45 → 0.5 → 0.55 → 0.75 → STEP 2 → 2.5), and the word "disaster" appears 10 times, each tied to a documented failure (e.g., the Peter Steinberger incident, the Hermes agent leaking internal evidence blocks, the Garry Tan case where four layers of defense still leaked).

A striking self-reported incident: on 2026-04-18, the same Opus 4.7 with nearly identical SKILL.md passed beta validation 10/10 but failed the public version 0/8 — differing only by three anchors (self-reported; only partially corroborated by the v3.0.9 release note).

Most notable is v3.0.9, "The Self-Debug Release": the author handed five separate Opus 4.7 instances their own failed outputs and asked them to debug themselves; three converged on "SKILL.md is too big and the LAWs are too deep," and their diagnoses were copy-pasted into code. Lesson: having LLMs debug LLMs beats repeatedly hand-tuning prompts.

Distribution-chain problems

• Broken release (v3.0.1): Excluding skills/ and .claude-plugin/ via .gitattributes shipped a crippled tarball; Claude Code /plugin install silently failed. Four hotfix releases within 22 hours.
• README lagging 11 versions: Code is at v3.22.0; all READMEs (including English) sit at v3.11.1 — overall neglect, not just localization debt.
• Issue #1081 (2026-08-30), "Version-labelled builds diverge": the maintainer's own ticket admitting the version-mismatch disease recurred after previous fixes (v3.0.9 PR #217/#229) and engineering guardrails (v3.3.0 STEP 0 stale-clone check).
• Flagged as dangerous: Another AI platform's (Hermes) installation-time scanner issued 19 findings and hard-blocked installation (PR #962, 2026-08-08).
• .skillignore scan evasion: Excluding assets/ and agents/ is reasonable, but one line excludes scripts/lib/vendor/ with a comment admitting a "vendored third-party X-search client, still installed" — runtime code bypassing the install-time scan.
• Stale User-Agent: USER_AGENT = "last30days-skill/3.0" while the actual version is 3.22.0.

Legal status: clear ToS violations, not gray area

• X ToS §4(iii): crawling/scraping "without our prior written consent is expressly prohibited"; the section also prohibits distributing products that enable violations — directly implicating distributors. Liquidated damages §5: $15,000 per million posts.
• Reddit: robots.txt tested as User-agent:* / Disallow:/; UA §7 prohibits scraping without written consent.
• LinkedIn §8.2(04): explicitly covers third-party data aggregators — ScrapeCreators falls squarely in scope.
• Reddit v. SerpApi/Perplexity/Oxylabs (1:25-cv-08736, SDNY): on 2026-07-31 the court found DMCA §1201(a) anti-circumvention claims valid; this project uses the same technique (cookie auth + frontend scraping).
• A grep for robots across the codebase returns zero hits — no robots.txt compliance logic.
• ScrapeCreators' own ToS pushes 100% compliance liability onto customers, requires indemnification, caps liability at amounts paid, and can terminate anytime forfeiting balances.

Verdict

The tool genuinely solves a real problem — a 268-second run delivered 11 community evidence items with engagement data, closer to "what communities actually discuss" than keyword search. But it is not what it claims. Its real knowledge asset isn't the 60k stars; it's the ten-disaster list inside SKILL.md, teaching that LLM reliability comes from LLMs debugging LLMs and physically moving critical rules toward the context front — not from better prompts.

Quick claims-vs-reality table

| Dimension | README claims | Measured reality | |---|---|---| | Data sources | 20 sources | 5 out of the box (rest need keys/CLI) | | Ranking core | Real engagement | Engagement 5% weight; rerank LLM 60% | | Reddit real scores | Free + real scores | 3 of 110 candidates scored (2.7%) | | LLM judging | AI-agent judge | Reports still produced after triple 502 failures | | ToS status | (unmentioned) | Clear violations (X §4(iii) / Reddit §7 / LinkedIn §8.2(04)) | | README version | v3.11.1 | Actual v3.22.0 — 11 versions behind | | Third-party audits | (unlisted) | Trust Hub Fail / Snyk Fail / Socket Warn |

Methodology: first-hand source-code analysis + full Windows real-machine run + direct GitHub API queries.

#deep-research #ai-agents #open-source #tos #last30days