_deliver_findings selected the Slack path with `"hooks.slack.com" in channel`,
an unanchored substring test that ran before any scheme check — while the
generic branch required https://. A delivery_channel like
http://evil.example/hooks.slack.com was therefore treated as Slack and POSTed
in cleartext to whatever host the URL actually named, leaking the notification
payload while the operator believed Slack was configured.
Parse the channel, require an https scheme, and match Slack on the exact
hostname (parsed.hostname == "hooks.slack.com") rather than a substring. A
non-https channel is now reported on stderr instead of being silently dropped.
Adds regression tests for the cleartext-bypass URL and for a URL carrying the
Slack host only in its path.
Add a pytest-discovered tests/conftest.py for the last30days scripts path and
remove duplicate per-file sys.path.insert boilerplate from tests.
Normalize affected imports to rely on the shared scripts path and remove the
now-unneeded E402 suppressions.
Five provider modules (pinterest, threads, instagram, tiktok, youtube_yt)
and watchlist.py each carried a try/except `requests` import with parallel
urllib + requests branches. The urllib path already used the
stdlib-only wrapper at `lib/http.py` (retries, 429 handling, HTTPError).
This collapses every dual-branch into a single `http.get`/`http.post`
call and removes the `requests` dependency from `pyproject.toml`.
Also drops 4 transitive deps (urllib3, certifi, charset-normalizer, idna)
from the lockfile, leaving the skill stdlib-only at runtime.
Tests for tiktok comments and watchlist delivery were rewritten to mock
`lib.http` directly instead of the now-removed `requests` module.
Out of scope but flagged during review: the 13 surviving SC call sites
share a near-identical scaffold and would benefit from a
`http.scrapecreators_get(url, params, token, ...)` helper. Filed for a
follow-up PR rather than expanding scope here.
Ilia Alshanetsky