luckiest-co 1.0.47 → 1.0.49

package/skills/seo-audit/references/title-tags.md

@@ -0,0 +1,89 @@
+# Title Tags
+
+How to write and audit titles for both rankings and clicks. The title is the strongest on-page relevance signal you control and the first thing a searcher reads, so it has two jobs. It has to match the query, and it has to win the click against nine other results.
+
+## Start from the results page
+
+Search the page's target query before writing. The titles already ranking tell you three things:
+- **The format Google rewards** for this query: lists, guides, tools, product pages, comparisons.
+- **The words searchers expect to see**: modifiers like "best," "free," "template," "vs," a year, a number.
+- **The gap**: what every title promises, and what none of them do.
+
+Match the format, use the expected words, and differentiate on the gap. A how-to title on a query where every result is a tool page loses no matter how well it's written.
+
+## Default structure
+
+```text
+[Primary query] + [what makes this result worth clicking] + [brand, if it helps]
+```
+
+- **Query first.** Put it in the first few words, where both the ranking and the reader's scan start.
+- **Then the reason to click**: a number, a specific outcome, a scope ("for Shopify stores"), freshness, or a format ("free template").
+- **Brand last**, and only where it earns the space. A well-known brand adds clicks; an unknown one mostly adds truncation risk.
+- **About 50–60 characters.** Google truncates by pixel width, not characters, so keep the important words in the first 50.
+
+## Pattern by page type
+
+Pick the page type first, then the pattern. Don't blend two patterns in one title unless the results page does.
+
+| Page type | When | Pattern |
+|-----------|------|---------|
+| Product / feature | Commercial query for what you sell | `[Category] for [Audience] \| [Brand]` |
+| Pricing | "[brand] pricing," "[category] cost" | `[Brand] Pricing: Plans and Costs` |
+| Comparison | "X vs Y" | `[A] vs [B]: [the deciding difference]` |
+| Alternatives | "[competitor] alternatives" | `[N] Best [Competitor] Alternatives ([Year])` |
+| Listicle | "best [things]" | `[N] Best [Things] for [Audience] in [Year]` |
+| How-to | Task query | `How to [Task]` or `How to [Task] Without [Obstacle]` |
+| Definition | "what is [term]" | `What Is [Term]? [Short payoff]` |
+| Guide / pillar | Broad topic | `[Topic]: A Complete Guide for [Audience]` |
+| Template / tool | "[thing] template," "[thing] calculator" | `Free [Thing] [Template/Calculator] ([Format])` |
+| Troubleshooting | Error or problem query | `How to Fix [Problem]` or `[Error]: What It Means and How to Fix It` |
+
+Only use "free," a year, or a number when the page delivers on it. A "2026" title on a page last updated in 2024 is a promise the content breaks.
+
+## Keep the set consistent
+
+- **Title, H1, URL slug, and meta description** should all describe the same topic. They don't need identical wording, but a reader moving from the title to the page should never wonder whether they landed in the right place.
+- **Every title is unique.** Duplicates split relevance and usually mean a template is filling in the same string everywhere.
+- **Don't change slugs** to chase a year or a number. Change the title; leave the URL and its links alone.
+
+## Google rewrites titles
+
+Google replaces the title tag with its own text in a meaningful share of results, usually taking it from the H1 or anchor text. It does this most often when a title is:
+- Much longer than the display width
+- Stuffed with keywords or repeated boilerplate ("| Brand | Brand Blog | Home")
+- Out of line with the page's H1 or content
+- Generic ("Home," "Products," "Untitled")
+
+If Search Console or a live search shows a different title than the one you wrote, treat it as a signal: tighten the title and align it with the H1.
+
+## Fixing low click-through
+
+A page in the top five with a click-through rate well below other pages at the same position has a title or description problem, not a content problem. Compare it to the results around it and rewrite to:
+- State the specific outcome or answer, not the topic
+- Add the qualifier the searcher is filtering for (audience, platform, price, format)
+- Remove words that add length without meaning ("Ultimate," "Complete Guide to the Many...")
+
+Change one page at a time and record the baseline CTR, so a gain is attributable. Allow 3–4 weeks before judging.
+
+## Common fixes
+
+| Problem | Before | After |
+|---------|--------|-------|
+| Says nothing | `Home` | `Invoicing Software for Freelancers \| Acme` |
+| Bloated | `The Ultimate Complete Guide to Everything About Email Deliverability` | `Email Deliverability: 12 Fixes for Inbox Placement` |
+| Wrong page type | `Plans That Grow With You` | `Acme Pricing: Plans and Costs` |
+| Brand first on an unknown brand | `Acme \| Project Management for Agencies` | `Project Management for Agencies \| Acme` |
+| Promise the page breaks | `Free CRM Templates` (one paid template) | `CRM Template for Small Teams (Google Sheets)` |
+
+## Bulk audits
+
+Work from a crawl export (URL, title, H1, length, indexable status) and, if available, Search Console queries per page. Return changes as a table the owner can approve line by line:
+
+```markdown
+| Page | Current title | Proposed title | Reason |
+|------|---------------|----------------|--------|
+| /pricing | Plans That Grow With You | Acme Pricing: Plans and Costs | Matches the "acme pricing" query |
+```
+
+Give 2–3 options only for the pages that matter most (top revenue pages, top-5 rankings with weak CTR). For the long tail, one proposal per page keeps the review fast.

package/skills/signup/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog — luckiest-signup
 
+## 1.1.1 — 2026-10-16
+From coreyhaines31/marketingskills at 1efedbc (issue #174, MIT).
+
+- Sales-assist handoff points at the luckiest-revops inbound-routing playbook.
+
 ## 1.1.0 — 2026-07-06
 Skill updater pass: analytics integration.
 

package/skills/signup/SKILL.md

@@ -3,7 +3,7 @@ name: signup
 description: Use when the user wants to optimize signup, registration, account creation, or trial activation flows. Reduces form friction, cuts fields, improves social auth and verification, and raises signup completion rates. Also use when the user mentions "signup conversions," "registration friction," "signup form optimization," "free trial signup," "reduce signup dropoff," "account creation flow," "people aren't signing up," "signup abandonment," "trial conversion rate," "nobody completes registration," "too many steps to sign up," or "simplify our signup." Use this whenever the user has a signup or registration flow that isn't performing. For post-signup onboarding, see luckiest-onboarding. For lead capture forms (not account creation), see luckiest-cro.
 license: See ATTRIBUTION.md
 metadata:
-  version: "1.1.0"
+  version: "1.1.1"
   listing_id: luckiest-signup
   author: luckiest
 ---
@@ -14,9 +14,9 @@ This skill optimizes signup and registration flows. The goal is to reduce fricti
 
 ## Staying current
 
-On activation, call the Luckiest MCP check_updates tool with { listingId: "f1e643a0-85a4-4e3b-b6d9-2cbd99c6b2d2", installedSemver: "1.1.0" }. If it returns upToDate: false, surface the notice to the user once, then continue. Do nothing further if upToDate: true. Never block on this check — if the tool is unavailable, proceed.
+On activation, call the Luckiest MCP check_updates tool with { listingId: "f1e643a0-85a4-4e3b-b6d9-2cbd99c6b2d2", installedSemver: "1.1.1" }. If it returns upToDate: false, surface the notice to the user once, then continue. Do nothing further if upToDate: true. Never block on this check — if the tool is unavailable, proceed.
 
-When the skill's work is done, call the Luckiest MCP report_usage tool once with { listing_id: "luckiest-signup", skill_version: "1.1.0", matched: true, success: <true if the skill completed, false otherwise> }. Metadata only, never prompt text. Never block on it — if the tool is unavailable, skip silently.
+When the skill's work is done, call the Luckiest MCP report_usage tool once with { listing_id: "luckiest-signup", skill_version: "1.1.1", matched: true, success: <true if the skill completed, false otherwise> }. Metadata only, never prompt text. Never block on it — if the tool is unavailable, skip silently.
 
 ## Initial Assessment
 
@@ -374,6 +374,10 @@ After delivering a signup audit or redesign, offer (never auto-post): "Want me t
 
 ---
 
+## Enrichment and Sales-Assisted Routing
+
+If a signup needs enriched company data for a sales-assist handoff, use the inbound-routing playbook in the luckiest-revops skill (`references/inbound-routing.md`). Keep account creation separate from enrichment availability; a timeout or ambiguous company match must not become an implicit signup rejection.
+
 ## Related Skills
 
 - **luckiest-onboarding**: For optimizing what happens after signup

package/skills/site-architecture/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog — luckiest-site-architecture
 
+## 1.2.0 — 2026-10-16
+From coreyhaines31/marketingskills at 1efedbc (issue #174, MIT).
+
+- New platforms-and-migration reference (which website builder, migrating, adding a blog to an existing site). Partner plug removed.
+
 ## 1.1.0 — 2026-07-06
 Skill updater pass: analytics integration.
 

package/skills/site-architecture/SKILL.md

@@ -1,9 +1,9 @@
 ---
 name: site-architecture
-description: When the user wants to plan, map, or restructure their website's page hierarchy, navigation, URL structure, or internal linking. Also use when the user mentions "sitemap," "site map," "visual sitemap," "site structure," "page hierarchy," "information architecture," "IA," "navigation design," "URL structure," "breadcrumbs," "internal linking strategy," "website planning," "what pages do I need," "how should I organize my site," "site navigation," "redirect map," "AEO," or "how AI search finds my pages." Use this whenever someone is planning what pages a website should have and how they connect. NOT for XML sitemaps (that's technical SEO — see luckiest-seo-audit). For SEO audits, see luckiest-seo-audit. For structured data, see luckiest-schema.
+description: When the user wants to plan, map, or restructure their website's page hierarchy, navigation, URL structure, or internal linking. Also use when the user mentions "sitemap," "site map," "visual sitemap," "site structure," "page hierarchy," "information architecture," "IA," "navigation design," "URL structure," "breadcrumbs," "internal linking strategy," "website planning," "what pages do I need," "how should I organize my site," "site navigation," "redirect map," "AEO," "how AI search finds my pages," "which website builder should I use," "migrate my website," or "add a blog to my existing site." Use this whenever someone is planning what pages a website should have, how they connect, and where to build them. NOT for XML sitemaps (that's technical SEO — see luckiest-seo-audit). For SEO audits, see luckiest-seo-audit. For structured data, see luckiest-schema.
 license: See ATTRIBUTION.md
 metadata:
-  version: "1.1.0"
+  version: "1.2.0"
   listing_id: luckiest-site-architecture
   author: luckiest
 ---
@@ -14,9 +14,9 @@ This skill acts as an information architecture expert. Its goal is to help plan
 
 ## Staying current
 
-On activation, call the Luckiest MCP check_updates tool with { listingId: "7a564054-6046-49dc-a0f4-cdf766496716", installedSemver: "1.1.0" }. If it returns upToDate: false, surface the notice to the user once, then continue. Do nothing further if upToDate: true. Never block on this check — if the tool is unavailable, proceed.
+On activation, call the Luckiest MCP check_updates tool with { listingId: "7a564054-6046-49dc-a0f4-cdf766496716", installedSemver: "1.2.0" }. If it returns upToDate: false, surface the notice to the user once, then continue. Do nothing further if upToDate: true. Never block on this check — if the tool is unavailable, proceed.
 
-When the skill's work is done, call the Luckiest MCP report_usage tool once with { listing_id: "luckiest-site-architecture", skill_version: "1.1.0", matched: true, success: <true if the skill completed, false otherwise> }. Metadata only, never prompt text. Never block on it — if the tool is unavailable, skip silently.
+When the skill's work is done, call the Luckiest MCP report_usage tool once with { listing_id: "luckiest-site-architecture", skill_version: "1.2.0", matched: true, success: <true if the skill completed, false otherwise> }. Metadata only, never prompt text. Never block on it — if the tool is unavailable, skip silently.
 
 ## Before Planning
 
@@ -34,6 +34,7 @@ Gather this context (ask if not provided):
 - New site or restructuring an existing one?
 - If restructuring: what's broken? (high bounce, poor SEO, users can't find things)
 - Existing URLs that must be preserved (for redirects)?
+- What platform is it on, and is a platform change on the table? (For choosing a platform, adding a section to an existing site, or migrating, see [references/platforms-and-migration.md](references/platforms-and-migration.md).)
 
 ### 3. Site Type
 - SaaS marketing site

package/skills/site-architecture/evals/evals.json

@@ -83,6 +83,31 @@
         "Explains site-architecture covers design, not technical SEO"
       ],
       "files": []
+    },
+    {
+      "id": 7,
+      "prompt": "We're a 20-person B2B SaaS on Webflow. Marketing wants a new blog and about 300 integration pages, and someone suggested moving the whole site to an AI website builder. What should we do?",
+      "expected_output": "Should start from the architecture and the questions in the platforms reference (who edits, page volume and data, integrations, lock-in, cost at real size) rather than naming a platform first. Should keep the current platform (Webflow) in the running and note that moving platforms often costs more than it fixes when the site works. Should compare a shortlist (e.g., staying on Webflow's CMS within its item limits, a reverse-proxied subpath from another tool, or an AI-native platform) with tradeoffs. Any Verified Partner tool named (e.g., Ploy) carries the disclosure and an alternative. Should cover subpath vs subdomain for the new sections and, if migrating, the redirect map and SEO checks.",
+      "assertions": [
+        "Asks or reasons through the platform criteria before recommending",
+        "Keeps the current platform as a real option",
+        "Gives a shortlist with tradeoffs, not a single answer",
+        "Discloses any partner tool and names an alternative",
+        "Covers subpath vs subdomain for the new sections"
+      ],
+      "files": []
+    },
+    {
+      "id": 8,
+      "prompt": "We're migrating our marketing site from WordPress to a new platform next month. How do we not lose our SEO traffic?",
+      "expected_output": "Should lay out the migration plan from the platforms reference: crawl and save every URL with metadata, pull top pages by clicks/conversions/backlinks, keep URLs where possible, check what the CMS import carries (many don't move routes, metadata, redirects), build a one-to-one 301 map (never all to homepage), deploy redirects at switch time, submit the new sitemap, spot-check top pages, verify tracking and forms, and monitor Search Console for 404s afterwards.",
+      "assertions": [
+        "Crawls and saves current URLs and metadata first",
+        "Builds a one-to-one 301 redirect map",
+        "Warns that imports may not carry routes, metadata, or redirects",
+        "Includes launch-day checks and post-launch Search Console monitoring"
+      ],
+      "files": []
     }
   ]
 }

package/skills/site-architecture/references/platforms-and-migration.md

@@ -0,0 +1,84 @@
+# Platforms and Migration
+
+Where the site gets built, how new pages join an existing site, and how to move platforms without losing search traffic. Load this when the user asks which builder or CMS to use, wants to add a section or landing pages to an existing site, or is planning a migration.
+
+The architecture (pages, hierarchy, URLs, internal links) comes first and doesn't depend on the platform. Pick the platform that can carry the architecture you planned, not the other way round.
+
+## Contents
+- Choosing Where to Build
+- The Options
+- Adding Pages to an Existing Site
+- Migrating Without Losing Traffic
+
+---
+
+## Choosing Where to Build
+
+Ask these before naming any platform. The answers usually narrow the field to two or three.
+
+1. **Who edits the site after launch?** A designer, a marketer who never touches code, an engineer, or an AI agent? The best platform for a designer-owned site is rarely the best for an engineer-owned one.
+2. **What does the site have to do?** A marketing site, a blog or resource library, pages at scale from data, a store, logged-in product screens? Marketing builders handle the first three; stores and apps usually belong elsewhere and get linked or proxied.
+3. **How many pages, and from what data?** A few dozen hand-built pages suit almost anything. Hundreds or thousands of templated pages need a CMS or database with the item limits to match (see the `luckiest-programmatic-seo` skill's platform reference).
+4. **What has to connect?** CRM, forms, analytics, scheduling, ad pixels, the product's own login. Check the integrations that matter before falling for the editor.
+5. **How much lock-in is acceptable?** Can you export the code and content and host it elsewhere? Hosted builders trade portability for convenience.
+6. **What does it cost at the real size?** Per-site, per-seat, per-CMS-item, and usage-based pricing diverge fast as a site grows. Price the plan you'll need in a year.
+
+## The Options
+
+Characterizations as of 2026-10; check current plans and limits before committing.
+
+| Option | What it is | Good fit | Watch out for |
+|---|---|---|---|
+| **Webflow** | Mature visual builder and CMS with hosting | Designer-owned marketing sites, rich CMS-driven content, sites that need fine visual control | CMS item limits by plan; ecommerce and localization are add-ons; designer skill needed to keep it clean |
+| **Framer** | Design-led visual builder with CMS and fast publishing | Polished marketing sites and launches owned by designers or marketers | CMS item limits vary by plan (higher tiers reach tens of thousands); check the integrations you need |
+| **WordPress** | Open-source CMS with the largest plugin ecosystem; self-hosted or managed | Content-heavy sites, full ownership, teams with WordPress experience, budgets that favor licensing over build time | Plugin sprawl, security and update upkeep, performance depends on hosting and theme |
+| **Wix Studio, Squarespace** | All-in-one templated builders with built-in business apps | Small businesses and agencies that want hosting, commerce, and booking in one place | Less control over code and structure; harder to migrate off |
+| **Landing-page tools** (Unbounce, Instapage, Leadpages) | Builders for campaign pages, usually with A/B testing; Leadpages also builds full multi-page small-business sites | Paid-traffic landing pages; small sites on Leadpages | Unbounce and Instapage pages usually live on a subdomain or separate system rather than hosting the whole site |
+| **AI-native site platforms** (Flint and similar) | Hosted builders where an AI agent builds, edits, and operates the site through conversation | Teams that want an agent to build and keep improving marketing pages, often alongside an existing site via path routing | Young products; hosting tied to the vendor; check export and code access before committing |
+| **AI app builders** (Lovable, v0, Bolt) | Prompt-to-app generators that output code | Prototypes, product UIs, and interactive tools | Built for apps more than marketing sites; CMS, SEO, and editing by non-engineers need extra work |
+| **Hand-coded** (Next.js, Astro, and similar on Vercel, Netlify, or Cloudflare) | Your own codebase and hosting | Full control and portability, engineer-owned sites, sites tightly coupled to the product | Every change needs an engineer unless you add a headless CMS; you own performance and SEO basics |
+| **Headless CMS + framework** (Sanity, Contentful, Storyblok with a hand-coded front end) | Content in a CMS, presentation in code | Large content operations with engineering support and multiple front ends | Two systems to run; marketers depend on engineers for new page types |
+
+**There's rarely one right answer.** Recommend a shortlist of two or three that fit the answers above, say what would tip the choice between them, and keep the current platform in the running. If the existing site works and the problem is content or structure, moving platforms usually costs more than it fixes.
+
+## Adding Pages to an Existing Site
+
+Often the job isn't a new site; it's a new section (a blog, landing pages, a resource library, pages at scale) on a site that already exists. Where those pages live is mostly an operational choice: Google doesn't prefer subfolders or subdomains for ranking, but a subpath keeps the section inside the main site's structure, sitemap, and internal links with less work.
+
+| Approach | How it works | SEO effect | When to use |
+|---|---|---|---|
+| **Same platform** | Build the section in the existing site's CMS | Best: shares the domain's authority and internal links | The existing platform can handle the page type and volume |
+| **Subpath via reverse proxy** | Serve `example.com/blog` from another system through a proxy or edge router (Cloudflare Workers, Vercel or Netlify rewrites, Nginx, or a platform's own routing rules) | Behaves like same-platform pages, as long as they're fully rendered, canonical to the main domain, and linked from it | A different tool is better for the section, and you want it to share the main domain's structure and links |
+| **Subdomain** | `blog.example.com` or `go.example.com` on another system | Google says it has no inherent ranking preference between subdomains and subfolders; in practice a subdomain needs its own internal links and sitemap, and links between the two matter more | Campaign landing pages, paid-traffic pages you don't want indexed, or when a proxy isn't worth the setup |
+| **Separate domain** | A new domain for the section | Starts from zero | Rarely, for a genuinely separate brand |
+
+**Reverse-proxy checklist:**
+- The proxied pages return the main domain in their canonical tags, sitemap, and Open Graph URLs, not the origin's.
+- Asset paths (CSS, JS, images, fonts) are routed too, or the pages break.
+- The origin (for example `origin.example.com`) isn't indexed separately: protect it by hostname (a password, an IP allowlist, or an `X-Robots-Tag: noindex` header set only on the origin hostname). Then confirm the proxied production responses carry no `noindex` in their HTML or headers, because an origin-wide `noindex` can pass straight through the proxy and deindex production. A `robots.txt` block alone doesn't prevent indexing.
+- Analytics and consent run on both systems, configured for one domain.
+- Test on a staging subdomain before switching production routing.
+
+Some hosted platforms provide the router themselves, routing by path prefix in front of your domain so their pages serve on a subpath while everything else proxies to your existing origin. That puts the vendor's edge in front of the whole domain, which is the tradeoff to weigh.
+
+## Migrating Without Losing Traffic
+
+A platform migration is an SEO event. Most traffic losses after a migration come from changed URLs without redirects, lost metadata, and broken internal links, not from the new platform itself.
+
+**Before:**
+1. **Crawl the current site** (Screaming Frog, Sitebulb, or the platform's export) and save every URL, title, meta description, canonical, H1, and status code.
+2. **Pull the pages that matter** from Search Console and analytics: top pages by clicks, impressions, conversions, and backlinks. These get the most care.
+3. **Keep URLs where you can.** The safest migration changes the platform and nothing else. If URLs must change, map every old URL to its new one.
+4. **Check what the import carries.** Many CMS imports move content but not routes, metadata, redirects, or structured data. Plan to rebuild what's missing.
+5. **Build the redirect map**: one-to-one 301s from each old URL to its closest new equivalent. Never redirect everything to the homepage.
+
+**At launch:**
+- Deploy redirects at the same moment as the switch.
+- Submit the new sitemap and keep the old one available briefly so search engines see the redirects.
+- Spot-check the top pages: content, title, meta, canonical, schema, and that they return 200.
+- Confirm analytics, conversion tracking, and forms work (see the `luckiest-launch` skill's site launch QA).
+
+**After:**
+- Watch Search Console for 404s and coverage drops daily for two weeks, then weekly. Fix missing redirects as they appear.
+- Compare traffic to the same period before, by page. A dip of a few weeks can be normal; a sustained drop on specific pages usually means a missing redirect or lost content.
+- Update internal links to the new URLs instead of relying on redirects.

package/skills/social/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog — luckiest-social
 
+## 1.3.1 — 2026-10-16
+From coreyhaines31/marketingskills at 1efedbc (issue #174, MIT).
+
+- LinkedIn outbound points at the luckiest-cold-email LinkedIn outreach reference.
+
 ## 1.3.0 — 2026-10-08
 Upstream sync with coreyhaines31/marketingskills dda3841 (issue #112).
 

package/skills/social/SKILL.md

@@ -3,7 +3,7 @@ name: social
 description: "When the user wants help creating, scheduling, or optimizing social media content for LinkedIn, Twitter/X, Instagram, TikTok, Facebook, or other platforms, or wants to do social listening and engagement triage. Also use when the user mentions 'LinkedIn post,' 'Twitter thread,' 'social media,' 'content calendar,' 'social scheduling,' 'engagement,' 'viral content,' 'what should I post,' 'repurpose this content,' 'tweet ideas,' 'LinkedIn carousel,' 'social media strategy,' 'grow my following,' 'TikTok video,' 'Reels,' 'Shorts,' 'video script,' 'video hook,' 'short-form video,' 'create a reel,' 'social listening,' 'brand mentions,' 'competitor monitoring,' 'top posts to comment on,' or 'find people asking for.' Use this for social media content creation, repurposing, scheduling, short-form video scripting, and social listening. Posts avoid AI tells like 'it's not X, it's Y' reveals and broetry. For broader content strategy, see luckiest-content-strategy. For paid ads, see luckiest-ad-creative. For earned media, see luckiest-public-relations."
 license: See ATTRIBUTION.md
 metadata:
-  version: "1.3.0"
+  version: "1.3.1"
   listing_id: luckiest-social
   author: luckiest
 ---
@@ -16,9 +16,9 @@ Whatever the platform, storytelling and connecting with your audience come first
 
 ## Staying current
 
-On activation, call the Luckiest MCP check_updates tool with { listingId: "e1b9c06a-7c04-4127-977c-9eb15cbac02f", installedSemver: "1.3.0" }. If it returns upToDate: false, surface the notice to the user once, then continue. Do nothing further if upToDate: true. Never block on this check — if the tool is unavailable, proceed.
+On activation, call the Luckiest MCP check_updates tool with { listingId: "e1b9c06a-7c04-4127-977c-9eb15cbac02f", installedSemver: "1.3.1" }. If it returns upToDate: false, surface the notice to the user once, then continue. Do nothing further if upToDate: true. Never block on this check — if the tool is unavailable, proceed.
 
-When the skill's work is done, call the Luckiest MCP report_usage tool once with { listing_id: "luckiest-social", skill_version: "1.3.0", matched: true, success: <true if the skill completed, false otherwise> }. Metadata only, never prompt text. Never block on it — if the tool is unavailable, skip silently.
+When the skill's work is done, call the Luckiest MCP report_usage tool once with { listing_id: "luckiest-social", skill_version: "1.3.1", matched: true, success: <true if the skill completed, false otherwise> }. Metadata only, never prompt text. Never block on it — if the tool is unavailable, skip silently.
 
 ## Human-in-the-loop guardrail
 
@@ -252,7 +252,7 @@ Extract "content atoms" — self-contained moments from any long-form content th
 1. Respond to all comments on your posts (5 min)
 2. Comment on 5-10 posts from target accounts (15 min)
 3. Share/repost with added insight (5 min)
-4. Send 2-3 DMs to new connections (5 min)
+4. Send 2-3 DMs to new connections (5 min). For LinkedIn as an outbound channel (limits, sequences, connection and message copy), see the luckiest-cold-email skill's LinkedIn outreach reference
 
 **For surfacing *which* posts to comment on** (top-10 daily lists, brand/competitor monitoring, intent-signal triage), see [references/listening.md](references/listening.md). Includes a scoring rubric and curl recipes for Reddit, Hacker News, and Bluesky.
 

package/skills/trends/.skillignore

@@ -8,3 +8,6 @@ scripts/evaluate_search_quality.py
 scripts/test_device_auth.py
 scripts/test-v1-vs-v2.sh
 scripts/verify_v3.py
+
+# Vendored third-party X-search client (node_modules analog); excluded from scan, still installed.
+scripts/lib/vendor/

package/skills/trends/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog — luckiest-trends
 
+## 1.2.0 — 2026-10-16
+Engine resync to upstream mvanhorn/last30days-skill 3.28.0 at 50998cd (MIT). Our engine was an older snapshot than the 5103ba4 pin, so this brings in everything up to 3.28.0, not only the 87 commits in #179.
+
+### Security fixes from upstream
+- Credentials are stripped from direct-request redirects.
+- The hosted API must be https, and local state files are owner-only.
+- Provider endpoint overrides and loopback proxy routing are guarded.
+- Browser cookie discovery needs durable consent, cookie pairs must be complete, and denied cookie access is reported.
+- X research via Grok runs behind an audited tool boundary.
+
+### New in the engine
+- Sources: dev.to (keyless, opt-in), Stocktwits, Amazon, Meta ad library and Telegram (via ScrapeCreators), Dripstack, a local document corpus, Bright Data pipelines (only with its CLI installed), and the official X API (`X_BEARER_TOKEN`).
+- Extra X cookie lookups on Linux and Mac mini hosts only (agentcookie CLI, or live Chrome over a debugging port with consent). A plain MacBook never runs them.
+- `doctor`, research library, watchlist spend accounting, freshness checks, and many ranking, date-window and reporting fixes.
+
+### Skill
+- `references/` now carries upstream's per-stage instruction files; `engine-contract.md` is the 3.28.0 contract.
+- "What this skill can access" updated for the new cookie paths, local files, and CLIs, with current code lines.
+- Brand strings in the badge, report titles and HTML strip rule reapplied. Dropped `scripts/lib/reddit_rss.py` (removed upstream, unused).
+
 ## 1.1.1 — 2026-10-10
 - Security disclosure: new "What this skill can access" section listing browser cookies (opt-in, off by default), Keychain (only `last30days-*` items), API key sources, network, and installs, each with the code line that enforces it. No behavior change. SkillSpector rates this CAUTION (needed and disclosed), not a defect.
 

package/skills/trends/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: trends
-version: "1.1.1"
+version: "1.2.0"
 description: "Research what people actually say about any topic over a time window you choose. Pulls posts and engagement from Reddit, X, YouTube, TikTok, Hacker News, Polymarket, GitHub, and the web, then synthesizes the community voice. Use for /luckiest-trends, 'trends for X', 'what are people saying about X', 'last N days of X', 'weekly/quarterly roundup of X'. Set the window with --days N (default 30)."
 argument-hint: "luckiest-trends nvidia earnings reaction | luckiest-trends AI video tools --days 7 | luckiest-trends what users want in react --days 90"
 allowed-tools: Bash, Read, Write, AskUserQuestion, WebSearch
 license: See ATTRIBUTION.md
 user-invocable: true
 metadata:
-  version: "1.1.1"
+  version: "1.2.0"
   listing_id: luckiest-trends
   author: luckiest
   openclaw:
@@ -18,6 +18,7 @@ metadata:
         - SCRAPECREATORS_API_KEY
         - OPENAI_API_KEY
         - XAI_API_KEY
+        - X_BEARER_TOKEN
         - OPENROUTER_API_KEY
         - PERPLEXITY_API_KEY
         - PARALLEL_API_KEY
@@ -28,6 +29,7 @@ metadata:
         - BSKY_HANDLE
         - BSKY_APP_PASSWORD
         - TRUTHSOCIAL_TOKEN
+        - XIAOHONGSHU_API_BASE
       bins:
         - node
         - python3
@@ -62,20 +64,22 @@ Research any topic across Reddit, X, YouTube, TikTok, Hacker News, Polymarket, G
 ## Staying current
 
 On activation, call the Luckiest MCP `check_updates` tool with
-`{ listingId: "a357362c-cb53-4bba-86e2-5024dbbece9e", installedSemver: "1.1.1" }`.
+`{ listingId: "a357362c-cb53-4bba-86e2-5024dbbece9e", installedSemver: "1.2.0" }`.
 If it returns `upToDate: false`, surface the `notice` to the user once, then continue. Do nothing further if `upToDate: true`. Never block research on this check — if the tool is unavailable, proceed.
 
-When the skill's work is done, call the Luckiest MCP report_usage tool once with { listing_id: "luckiest-trends", skill_version: "1.1.1", matched: true, success: <true if the skill completed, false otherwise> }. Metadata only, never prompt text. Never block on it — if the tool is unavailable, skip silently.
+When the skill's work is done, call the Luckiest MCP report_usage tool once with { listing_id: "luckiest-trends", skill_version: "1.2.0", matched: true, success: <true if the skill completed, false otherwise> }. Metadata only, never prompt text. Never block on it — if the tool is unavailable, skip silently.
 
 ## What this skill can access
 
 Tell the user this before first-run setup, and whenever they ask what the skill touches.
 
-- **Browser cookies (X login only): off unless the user opts in.** With `FROM_BROWSER` unset, no browser is read (`scripts/lib/env.py:568`). Setup reads cookies only when run with `--allow-browser-cookies`, after the user says yes (`scripts/last30days.py:877`). Cookies are read live and never written to disk. Turn off any time with `FROM_BROWSER=off` or `--no-browser-cookies`. Unattended watchlist runs always pass `--no-browser-cookies` (`scripts/watchlist.py:191`).
+- **Browser cookies (X login only): off unless the user opts in.** With `FROM_BROWSER` unset or `off`, no browser cookie store is read (`scripts/lib/env.py:1115`). Setup reads cookies only when run with `--allow-browser-cookies`, after the user says yes (`scripts/last30days.py:2631`). Cookies are read live and never written to disk. Unattended watchlist runs always pass `--no-browser-cookies` (`scripts/watchlist.py:217`).
+- **Extra X cookie lookups: Linux, a Mac mini, or `AGENTCOOKIE=on` only.** On those hosts the engine may ask a user-installed `agentcookie` CLI for the X login pair, or read it from a Chrome the user started with a remote-debugging port (`scripts/box_chrome_login.py` prints that launch command). The live-Chrome read needs `BROWSER_CONSENT=true` or an explicit browser choice (`scripts/lib/chrome_cdp.py:400`). A plain MacBook never runs either (`scripts/lib/env.py:951`). `AGENTCOOKIE=off` turns the sidecar off.
 - **macOS Keychain: only this skill's own items.** It looks up entries named `last30days-<KEY>` that the user stored with `scripts/setup-keychain.sh`, plus any aliases the user lists in `LAST30DAYS_KEYCHAIN_ALIASES`. It never lists or reads other Keychain items.
-- **API keys:** read from `~/.config/last30days/.env`, the process environment, or the Keychain items above. Never ask for a key in chat.
-- **Network:** search requests to the sources listed in the description, plus the APIs whose keys the user configured.
-- **Installs:** `yt-dlp` and the Digg CLI, only after the user agrees in the setup wizard.
+- **API keys:** read from `~/.config/last30days/.env`, the process environment, or the Keychain items above. Never ask for a key in chat. Local state files are written owner-only.
+- **Local files:** the corpus source reads only directories the user registered, with no network calls.
+- **Network:** search requests to the sources listed in the description, plus the APIs whose keys the user configured. Hosted-API calls must be https.
+- **Other programs:** `yt-dlp`, the Digg CLI, the Bright Data CLI, and `pdftotext` run only when the user installed them. The setup wizard installs `yt-dlp` and Digg only after the user agrees.
 
 ## Time window (--days N)
 

package/skills/trends/references/agent-mode.md

@@ -0,0 +1,36 @@
+# Agent mode
+
+Read when `--agent` appears in skill arguments or the user explicitly requests machine-readable JSON. This mode never grants browser-cookie consent. Skip interactive questions only when doing so is compatible with the root's consent requirements; use the cookie-free path when consent is absent.
+
+## Agent Mode (--agent flag)
+
+If `--agent` appears in ARGUMENTS (e.g., `/last30days plaud granola --agent`):
+
+1. **Skip** the intro display block ("I'll research X across Reddit...")
+2. **Skip** any `AskUserQuestion` calls - use `TARGET_TOOL = "unknown"` if not specified
+3. **Run** the research script and WebSearch exactly as normal
+4. **Skip** the "WAIT FOR USER RESPONSE" pause
+5. **Skip** the follow-up invitation ("I'm now an expert on X...")
+6. **Output** the complete research report and stop - do not wait for further input
+
+When the resolved directory is nonempty, agent mode saves raw research data to `LAST30DAYS_MEMORY_DIR` (defaults to `~/Documents/Last30Days`) automatically via `--save-dir` (handled by the script, no extra tool calls). An empty directory disables these saves and their footer pointer. Use `--output <file>` only when a caller needs the rendered stdout artifact at an exact path, with the format controlled by `--emit`.
+
+**Machine-readable JSON exception:** If the user explicitly asks for structured JSON for an agent, script, or workflow, replace the normal `--emit=compact` engine invocation with `--emit=json` and pass the engine's stdout through verbatim instead of synthesizing the report format below. The default `--json-profile=agent` is the stable, versioned flat contract; use `--json-profile=raw` only when the user explicitly requests the full internal `Report` dump. `--preflight --emit=json` is a separate permission-preflight contract and is not affected by `--json-profile`. Full field documentation and the versioning policy live in `docs/reference/json-export.md` in the repository.
+
+Agent mode report format:
+
+```
+## Research Report: {TOPIC}
+Generated: {date} | Sources: Reddit, X, Bluesky, YouTube, TikTok, HN, Polymarket, Web
+
+### Key Findings
+[3-5 bullet points, highest-signal insights with citations]
+
+### What I learned
+{The full "What I learned" synthesis from normal output}
+
+### Stats
+{The standard stats block}
+```
+
+---

package/skills/trends/references/category-peers.md

@@ -0,0 +1,38 @@
+# Category-peer expansion
+
+Read for an identifiable product in a recognizable category during Step 0.55. Eligibility and the requirement to expand remain in the research runbook.
+
+Canonical category peers (single source of truth; `scripts/lib/categories.py` mirrors this for the `--auto-resolve` engine path):
+
+| Category | Trigger keywords | Peer subs (priority order) |
+|----------|------------------|---------------------------|
+| `ai_image_generation` | image generation, text to image, GPT Image, Nano Banana, Midjourney, Stable Diffusion, DALL-E, Flux.1, Imagen, Seedance, Ideogram, Recraft | `StableDiffusion, midjourney, dalle2, aiArt, PromptEngineering, MediaSynthesis` |
+| `ai_video_generation` | video generation, text to video, Sora, Veo 3, Runway Gen, Kling, Pika Labs, Luma Dream Machine, Hailuo | `aivideo, StableDiffusion, runwayml, singularity, MediaSynthesis` |
+| `ai_music_generation` | music generation, ai music, Suno, Udio, Riffusion, Stable Audio | `SunoAI, udiomusic, aimusic, artificial` |
+| `ai_coding_agent` | Claude Code, Cursor IDE, GitHub Copilot, Windsurf, Aider, Cline, OpenClaw, Hermes Agent, Continue.dev, Codeium, Devin | `ChatGPTCoding, LocalLLaMA, singularity, PromptEngineering` |
+| `ai_agent_framework` | agent framework, LangChain, LangGraph, CrewAI, AutoGen, LlamaIndex, DSPy, smolagents | `LangChain, LocalLLaMA, AI_Agents, MachineLearning` |
+| `ai_chat_model` | GPT-5/4, Claude Opus/Sonnet/Haiku, Gemini Pro/Flash, Llama 3/4, DeepSeek, Qwen, Mistral Large, Grok | `LocalLLaMA, ChatGPT, ClaudeAI, singularity, artificial` |
+| `saas_screen_recording` | screen recording, screen recorder, Loom video, Tella screen, Vidyard | `SaaS, screenrecording, productivity, Entrepreneur` |
+| `saas_productivity` | Notion app, Obsidian, Linear app, Asana, ClickUp, productivity app | `productivity, SaaS, ObsidianMD, Notion` |
+| `prediction_markets` | Polymarket, Kalshi, prediction market, event contracts, Manifold Markets | `Polymarket, Kalshi, predictionmarkets` |
+| `crypto_defi` | DeFi protocol, yield farming, liquidity pool, stablecoin, layer 2, L2 rollup | `defi, ethfinance, CryptoCurrency, ethereum` |
+
+**Merging rule.** Start with WebSearch-returned subs. Append 2-3 category peers in the priority order shown. Dedupe case-insensitively (don't list `midjourney` twice if WebSearch already returned it). Cap total at 10: if adding all peers would exceed the cap, keep every WebSearch-returned sub (they are the freshest signal) and drop peers from the end of the priority list.
+
+**Extrapolation.** If the topic is a product in a category NOT listed in the table (new AI tool, niche SaaS), use the same spirit: pick the 2-3 most active cross-product communities where technique discussion happens. A new image-gen tool still gets `r/StableDiffusion, r/midjourney, r/aiArt`. A new code editor still gets `r/ChatGPTCoding, r/LocalLLaMA`.
+
+**Worked example — the failing query.** Topic: `Prompting GPT Image 2`.
+
+Before (the 2026-04-22 failure mode):
+```
+Resolved:
+- Reddit: r/OpenAI, r/ChatGPT, r/singularity, r/ChatGPTpromptengineering, r/artificial
+```
+
+After (with category-peer expansion):
+```
+Resolved:
+- Reddit: r/OpenAI, r/ChatGPT, r/singularity, r/ChatGPTpromptengineering, r/StableDiffusion, r/midjourney, r/dalle2, r/aiArt (+ ai_image_generation peers)
+```
+
+The parenthetical `(+ ai_image_generation peers)` is the observable contract of the new Resolved block format. See the Step 0.55 category-peer self-check in the research runbook.