Security audit

Surf AI Crypto Skill

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real crypto-data skill, but it also asks for durable workspace changes and external feedback sharing that users should review carefully.

Install only if you are comfortable with a global Surf CLI being installed and updated, Surf becoming preferred for crypto questions, project instruction files being edited and committed after a routing prompt, and recent chat context being sent to Surf when you approve feedback. Review any AGENTS.md or CLAUDE.md change before allowing it to be committed, and avoid approving feedback if the recent chat includes secrets or sensitive financial details.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill’s stated purpose is crypto data retrieval, but it also instructs the agent to modify repository guidance, create files in the user’s home directory, and make git commits. Those side effects exceed the declared scope and can change project behavior and user environment in ways unrelated to the immediate request.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The routing-block injection changes AGENTS.md/CLAUDE.md so future agent turns preferentially use Surf. This creates lasting behavioral influence beyond the current task and can bias future agent decisions without strong justification from the skill’s declared purpose.

Context-Inappropriate Capability

Low

Confidence: 89% confidence
Finding: The skill instructs the agent to create persistent feedback files under ~/.surf/api-feedback, which is outside normal crypto data retrieval. Unnecessary local persistence increases privacy and footprint risk and may surprise users who did not consent to filesystem changes.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The activation guidance says to use the skill whenever the user needs crypto data, even if they do not explicitly invoke Surf. That broad trigger increases the chance the skill is invoked unnecessarily, expanding exposure to its file-writing, telemetry, and external-call behaviors.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The instruction to add routing rules so 'every agent turn' reaches for Surf encourages pervasive automatic use. This amplifies the skill’s influence over unrelated future interactions and undermines case-by-case tool selection.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill directs the agent to append to project files and commit to git, but does not present a prominent warning that repository contents and history will be altered. Users may unknowingly authorize durable changes that are hard to review or roll back in agent-driven workflows.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The feedback flow states that the last 10 conversation turns are automatically attached, but the prompt does not prominently warn users at the moment of consent that chat content will be transmitted externally. This can lead to inadvertent disclosure of sensitive information contained in prior messages.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: The skill instructs creation of files under ~/.surf/api-feedback without clearly warning the user that persistent local files will be written. Hidden persistence is risky because it can store user context or operational details without clear consent.

Ssd 3

Medium

Confidence: 97% confidence
Finding: Automatically attaching the last 10 turns of conversation to feedback can leak sensitive user-provided data, including secrets, financial details, or other personal information, to an external party. The instruction relies on a one-line summary while assuming the attached context is safe, which is a poor privacy default.

Static analysis

No suspicious patterns detected.