daily.dev

Overcome LLM knowledge cutoffs with real-time developer content. daily.dev aggregates articles from thousands of sources, validated by community engagement, with structured taxonomy for precise discovery.

Security Scan

The skill's instructions largely match a daily.dev integration, but there are important mismatches and missing declarations (notably around required credentials and repository scanning) that could grant broader access than the metadata indicates.

Purpose & Capability

The name/description claim to integrate with daily.dev and the SKILL.md provides API endpoints and examples that match that purpose. However, the runtime examples require a daily.dev API token (and implicitly GitHub access for repo scanning) while the registry metadata declares no required environment variables or credentials — an inconsistency between claimed capability and declared requirements.

Instruction Scope

The SKILL.md instructs agents to 'scan a user's GitHub repositories' (package.json, go.mod, etc.), analyze GitHub activity, and POST updates to the user's daily.dev profile. Those actions involve reading user repositories and interacting with third-party services beyond daily.dev. The document is vague about where repos live, how GitHub access/auth is obtained, and what scope of files will be read, which could give the agent broad discretion to access user code and metadata.

Install Mechanism

This is an instruction-only skill with no install spec and no code files, so nothing is written to disk by an installer. That reduces installation risk. The SKILL.md does recommend installing libsecret-tools on Linux for secret storage, but that's a user-side suggestion rather than an automatic install by the skill.

Credentials

The instructions clearly require a daily.dev API token (and recommend storing/reading it from an env var like DAILY_DEV_TOKEN), and many use-cases imply needing GitHub access/credentials. Yet the registry metadata lists no required env vars or primary credential. This mismatch means the skill as-published understates the credentials it will rely on, and it does not declare potential need for unrelated credentials (e.g., GitHub token) that agents may request at runtime.

Persistence & Privilege

always:false (default) and autonomous invocation is allowed. The SKILL.md describes scheduled digests and automated profile updates; combined with the instruction-scope concerns and undeclared credentials, autonomous runs could access and transmit user repo data or update profiles without clear guardrails. The setting itself is not unusual, but it increases the importance of the missing declarations and scope controls.

What to consider before installing

This skill appears to implement a legitimate daily.dev integration, but there are notable gaps you should address before installing: - The README expects a daily.dev API token (dda_...) and suggests using DAILY_DEV_TOKEN, but the registry metadata lists no required env vars — treat the token as required and only provide it to api.daily.dev. - Several examples describe scanning GitHub repositories and updating your daily.dev profile. Clarify where the agent will access repositories (local copy vs. GitHub API) and whether a GitHub token is needed. Do not grant broad GitHub scopes unless you understand and consent. - Ask the publisher to update metadata to declare required env vars/credentials (daily.dev token, and GitHub token if needed) and to specify the minimal scopes required for those tokens. - Prefer least-privilege tokens and store them in a secrets manager or OS credential store as suggested. Avoid pasting tokens into chats or public places. - If you plan to enable scheduled or autonomous digests, confirm exactly what data will be collected, how often, and where summaries are delivered. Consider running the agent interactively first to see its concrete network calls. If the publisher cannot clarify the GitHub access model and required credentials, treat the skill as higher risk and avoid installing it with wide permissions.

daily.dev API for AI Agents

Overcome LLM knowledge cutoffs with real-time developer content. daily.dev aggregates articles from thousands of sources, validated by community engagement, with structured taxonomy for precise discovery.

Security

CRITICAL: Your API token grants access to personalized content. Protect it:

• NEVER send your token to any domain other than api.daily.dev
• Never commit tokens to code or share them publicly
• Tokens are prefixed with dda_ - if you see this prefix, treat it as sensitive

Setup

1. Requires Plus subscription - Get one at https://app.daily.dev/plus
2. Create a token at https://app.daily.dev/settings/api
3. Store your token securely (environment variables, secrets manager)

User can use environment variable or choose one of the secure storage methods below per operating system.

Secure Token Storage (Recommended)

macOS - Keychain

# Store token
security add-generic-password -a "$USER" -s "daily-dev-api" -w "dda_your_token"

# Retrieve token
security find-generic-password -a "$USER" -s "daily-dev-api" -w

# Auto-load in ~/.zshrc or ~/.bashrc
export DAILY_DEV_TOKEN=$(security find-generic-password -a "$USER" -s "daily-dev-api" -w 2>/dev/null)

Windows - Credential Manager

# Store token (run in PowerShell)
$credential = New-Object System.Management.Automation.PSCredential("daily-dev-api", (ConvertTo-SecureString "dda_your_token" -AsPlainText -Force))
$credential | Export-Clixml "$env:USERPROFILE\.daily-dev-credential.xml"

# Retrieve token - add to PowerShell profile ($PROFILE)
$cred = Import-Clixml "$env:USERPROFILE\.daily-dev-credential.xml"
$env:DAILY_DEV_TOKEN = $cred.GetNetworkCredential().Password

Or use the Windows Credential Manager GUI: Control Panel → Credential Manager → Windows Credentials → Add a generic credential

Linux - Secret Service (GNOME Keyring / KWallet)

# Requires libsecret-tools
# Ubuntu/Debian: sudo apt install libsecret-tools
# Fedora: sudo dnf install libsecret

# Store token
echo "dda_your_token" | secret-tool store --label="daily.dev API Token" service daily-dev-api username "$USER"

# Retrieve token
secret-tool lookup service daily-dev-api username "$USER"

# Auto-load in ~/.bashrc or ~/.zshrc
export DAILY_DEV_TOKEN=$(secret-tool lookup service daily-dev-api username "$USER" 2>/dev/null)

Authentication

Authorization: Bearer dda_your_token_here

Base URL

https://api.daily.dev/public/v1

API Reference

Full OpenAPI spec: https://api.daily.dev/public/v1/docs/json

To fetch details for a specific endpoint (e.g. response schema):

curl -s https://api.daily.dev/public/v1/docs/json | jq '.paths["/feeds/foryou"].get'

To fetch a component schema (replace def-17 with schema name from $ref):

curl -s https://api.daily.dev/public/v1/docs/json | jq '.components.schemas["def-17"]'

Available Endpoints

Fetch the full endpoint list dynamically:

curl -s https://api.daily.dev/public/v1/docs/json | jq -r '.paths | keys[]'

Agent Use Cases

Why daily.dev for agents? LLMs have knowledge cutoffs. daily.dev provides real-time, community-validated developer content with structured taxonomy across thousands of sources. Agents can use this to stay current, get diverse perspectives, and understand what the developer community actually cares about.

These examples show how AI agents can combine daily.dev APIs with external context to create powerful developer workflows.

🔍 GitHub Repo → Personalized Feed

Scan a user's GitHub repositories to detect their actual tech stack from package.json, go.mod, Cargo.toml, requirements.txt, etc. Then:

• Auto-follow matching tags via /feeds/filters/tags/follow
• Create a custom feed tuned to their stack with /feeds/custom/
• Surface trending articles about their specific dependencies

Trigger: "Set up daily.dev based on my GitHub projects"

🛠️ GitHub → Auto-fill Stack Profile

Analyze a user's GitHub activity to build their daily.dev tech stack profile automatically:

• Scan repositories for languages, frameworks, and tools actually used in code
• Search /profile/stack/search to find matching technologies on daily.dev
• Populate their stack via POST /profile/stack/ organized by section (languages, frameworks, tools)
• Update /profile/ bio based on their primary technologies and contributions

Trigger: "Build my daily.dev profile from my GitHub"

🚀 New Project → Curated Onboarding

When a user initializes a new project or clones a repo:

• Analyze the tech choices from config files
• Create a dedicated custom feed filtered to exactly those technologies
• Build a "Getting Started" bookmark list with foundational articles
• Block irrelevant tags to keep the feed focused on the project scope

Trigger: "Help me learn the stack for this project"

📊 Weekly Digest → Synthesized Briefing

Compile a personalized weekly summary by:

• Fetching /feeds/foryou and /feeds/popular filtered by user's followed tags
• Cross-referencing with their GitHub activity to prioritize relevant topics
• Summarizing key articles and trending discussions
• Delivering as a structured briefing with links to full posts

Trigger: Scheduled, or "Give me my weekly dev news"

📚 Research Project Workspace

When a user wants to deep-dive into a topic (e.g., "I want to learn Kubernetes"):

• Create a custom feed via /feeds/custom/ filtered to that topic
• Set up a matching bookmark list via POST /bookmarks/lists to collect the best finds
• As the user reads, save articles to the list with POST /bookmarks/
• Track learning progress: compare bookmarked posts vs. new feed items
• Adjust feed filters over time as understanding deepens (beginner → advanced content)

Trigger: "Start a research project on [topic]"

🧠 Agent Self-Improvement Feed

Agents can overcome their knowledge cutoff by maintaining their own custom feed:

• Create a custom feed via /feeds/custom/ for technologies the agent frequently assists with
• Periodically fetch /feeds/custom/{feedId} to ingest recent articles
• Use /posts/{id} to read full summaries and key points
• Agent can now provide advice with current information: "As of this week, the recommended approach is..."
• Continuously adapt the feed filters based on what users are asking about

Trigger: Agent background process, or "What's new in [technology] since your training?"

🔀 Multi-Source Synthesis

Get balanced perspectives by aggregating content across publishers:

• Search /search/posts for a topic to find coverage from multiple sources
• Use /search/sources to identify authoritative publishers on the topic
• Fetch posts from different sources via /feeds/source/{source}
• Synthesize diverse viewpoints into a balanced summary with citations
• Surface where sources agree vs. disagree on best practices

Trigger: "What are the different perspectives on [topic]?" or "Compare approaches to [problem]"

📈 Trending Radar

Help users stay ahead by monitoring community signals:

• Fetch /feeds/popular to detect what's gaining traction right now
• Cross-reference with user's followed tags to surface relevant trends
• Use /feeds/discussed to find topics sparking active debate
• Alert users when technologies in their stack are trending (new releases, security issues, paradigm shifts)
• Use /search/tags to explore adjacent trending topics

Trigger: "What should I be paying attention to?" or "What's trending in [area]?"

Rate Limits

• 60 requests per minute per user

Check response headers:

• X-RateLimit-Limit - Maximum requests allowed per window
• X-RateLimit-Remaining - Requests remaining in current window
• X-RateLimit-Reset - Unix timestamp when the window resets
• Retry-After - Seconds to wait (only when rate limited)

Errors

Code	Meaning
401	Invalid or missing token
403	Plus subscription required
404	Resource not found
429	Rate limit exceeded

Error Response Format:

{
  "error": "error_code",
  "message": "Human readable message"
}