Surfline (public)
v0.1.0Get surf forecasts and current conditions from Surfline public endpoints (no login). Use to look up Surfline spot IDs, fetch forecasts/conditions for specific spots, and summarize multiple favorite spots.
⭐ 3· 1.8k·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description say 'public Surfline endpoints (no login)' and the code exclusively queries https://services.surfline.com endpoints (search, kbyg/*). The provided search, report, and favorites functionality matches the claimed purpose.
Instruction Scope
SKILL.md instructs running the included Python scripts. The scripts only perform HTTP GETs to Surfline, parse JSON, and output summaries/JSON. They also read a user favorites config (~/.config/surfline/favorites.json) and write/read a cache (~/.cache/surfline by default), which is documented in the README; this is within the skill's stated scope.
Install Mechanism
There is no install spec (instruction-only), and the Python scripts use only the standard library. One mismatch: registry metadata lists no required binaries but SKILL.md commands assume python3 is available. That is minor (standard expectation) but worth noting.
Credentials
The skill declares no required env vars or credentials. The code does read optional env vars SURFLINE_CACHE_DIR and SURFLINE_CACHE_TTL_SEC (non-sensitive, control cache location/TTL) and otherwise accesses user files under the home directory (favorites config and cache). These accesses are proportional to the feature and documented in SKILL.md.
Persistence & Privilege
always: false and no special persistence requested. The skill creates and uses its own cache/config paths and does not attempt to modify other skills or system-wide settings.
Assessment
This skill appears to do what it claims: query Surfline public endpoints and summarize results. Before installing, note: (1) the author is unknown — if you need stronger assurance, review the included Python files yourself; (2) it requires python3 at runtime (not declared in registry metadata); (3) it will read ~/.config/surfline/favorites.json (if you use favorites) and create/read cache files under ~/.cache/surfline by default — you can set SURFLINE_CACHE_DIR and SURFLINE_CACHE_TTL_SEC to control this; (4) it uses the network to contact services.surfline.com and sets a custom User-Agent; (5) run in a sandbox if you prefer, but no credentials or secrets are requested and there is no suspicious or obfuscated behavior in the code.Like a lobster shell, security has layers — review code before you run it.
latestvk97fpdcx8m95nvn2n6wajbqyxs7zyt13
License
MIT-0
Free to use, modify, and redistribute. No attribution required.