surrealism
PassAudited by ClawScan on May 1, 2026.
Overview
This instruction-only skill is coherent with SurrealDB WASM extension development, but users should notice that it guides local tool use, database login, and persistent module registration.
This skill appears safe as an instruction-only development guide. Before installing or using it, confirm you are working against a local/test SurrealDB instance, review any Rust/WASM code before registering it, and do not use root database credentials for production deployments.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Running the documented workflow can create local project files and modify a SurrealDB database by adding a module.
The skill documents commands that compile a WASM artifact and register it as a database module, which can change database behavior. This is central to the stated purpose and shown in a local development context.
surreal module compile ... DEFINE BUCKET my_bucket; ... DEFINE MODULE my_extension FROM 'my_bucket:my_extension.wasm';
Use the workflow in a local or test database first, and review generated WASM and SurrealQL before applying it to shared or production databases.
If adapted to a real database, these commands could run with administrative database privileges.
The Quick Start demonstrates connecting with root database credentials. The example is scoped to localhost and a test namespace/database, but root access is still high privilege.
surreal sql --endpoint http://localhost:8000 --user root --pass root --ns test --db test
Avoid using root credentials outside local testing; use least-privilege accounts and confirm the endpoint, namespace, and database before registering modules.
Users may need to install or verify Rust and SurrealDB CLI tools before following the workflow.
The skill relies on external development tools, while the registry requirements list no required binaries. This is under-declared metadata rather than hidden execution because the prerequisites are clearly stated in SKILL.md.
Rust toolchain (stable) with `wasm32-unknown-unknown` target; SurrealDB CLI v3.0.0+
Install tooling from official sources and verify versions before compiling or deploying WASM modules.