Surf Check

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:23 PM UTC
• Version: 0.2.2

Overview

This surf-alert skill is mostly purpose-aligned, but it handles Surfline login/session data in a way that needs review before installation.

Review this before installing if you plan to use Surfline Premium login. Treat data/session/cookies.json as a sensitive account session, restrict its permissions, exclude data/session and data/state.json from commits and packages, and delete/revoke the session if exposed. Prefer lockfile-controlled local script execution instead of floating npx in cron jobs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/login-surfline.ts:23

Finding

Surfline Session Cookies and Login Screenshots Are Stored Without Restrictive Access Controls

Content

View full analysis

{ try { const data = await fs.readFile(COOKIES_FILE, 'utf-8'); return JSON.parse(data); } catch (error) { throw new Error( 'Session cookies not found. Run "npx ts-node scripts/login-surfline.ts" first.' ); } } function formatCookieHeader(cookies: Cookie[]): string { return cookies .filter((c) => c.domain.includes('surfline.com')) .map((c) => `${c.name}=${c.value}`) .join('; '); } ``` ### Technical Analysis Playwright browser cookies can contain reusable authenticated session tokens. The application serializes all cookies ...[truncated 3287 chars]

Remediation

View remediation

domain === 'surfline.com' || domain === '.surfline.com' || domain.endsWith('.surfline.com'); ``` Also reject malformed cookie names or values containing control characters before constructing a request header. 8. Document session revocation and recovery procedures, including deleting `cookies.json`, logging out of Surfline, and rotating the account password when sess ...[truncated 32 chars]

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (43)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 172)May include surrounding context.

To reset and re-output all conditions:

bash

rm data/state.json

Turning Decisions into Alerts

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Fetching external Surfline API data is a substantive capability beyond an output-only decision engine, especially when permissions are not declared. The danger is not the network call alone but the concealment of external data acquisition, which can lead to unreviewed third-party interactions, policy violations, or unexpected data flows.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Fetching external Surfline API data is a substantive capability beyond an output-only decision engine, especially when permissions are not declared. The danger is not the network call alone but the concealment of external data acquisition, which can lead to unreviewed third-party interactions, policy violations, or unexpected data flows.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

Fetching external Surfline API data is a substantive capability beyond an output-only decision engine, especially when permissions are not declared. The danger is not the network call alone but the concealment of external data acquisition, which can lead to unreviewed third-party interactions, policy violations, or unexpected data flows.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Fetching external Surfline API data is a substantive capability beyond an output-only decision engine, especially when permissions are not declared. The danger is not the network call alone but the concealment of external data acquisition, which can lead to unreviewed third-party interactions, policy violations, or unexpected data flows.

Content

No source excerpt is available for this finding.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md

**No output from cron:** Normal if nothing qualifies or already reported. Run `npm run check:debug` to see evaluation.

**Reset state:** `rm {baseDir}/data/state.json` to re-report all conditions.

**Add a spot:** Edit `src/types.ts` or use `~/.surf-check.json` config.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md

**No output from cron:** Normal if nothing qualifies or already reported. Run `npm run check:debug` to see evaluation.

**Reset state:** `rm {baseDir}/data/state.json` to re-report all conditions.

**Add a spot:** Edit `src/types.ts` or use `~/.surf-check.json` config.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · src/services/state.ts (reported line 113)May include surrounding context.

ts

for (const key of Object.keys(state.alertsSent)) {
    const dateStr = key.split(':')[1];
    if (dateStr < cutoffStr) {
      delete state.alertsSent[key];
    }
  }
}

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 66)May include surrounding context.

Configuration

Create a config file at ~/.surf-check.json (global) or ./surf-check.json (local):

json

{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 202)May include surrounding context.

bash

#!/bin/bash
OUTPUT=$(cd /path/to/surf-check && npm run check:cron 2>/dev/null)
[ -n "$OUTPUT" ] && curl -d "$OUTPUT" https://your-webhook-url

Cron + Email

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill metadata explicitly declares runtime requirements including environment variables and, per the findings, the implementation performs network access, but the skill file does not declare any tool scope or allowed permissions. This creates a transparency and governance gap: an agent may execute code with broader capabilities than reviewers or users expect, increasing the risk of unintended data access or outbound communication.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

Default spots: Belmar (16th Ave), Long Branch (NJ)

To customize, create ~/.surf-check.json:

json

{

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The npm scripts invoke npx tsx, which can resolve and execute a package version at runtime rather than a fully fixed artifact. Even though tsx is also listed in devDependencies, using npx in automation increases supply-chain risk if the environment lacks a locked install or permits unexpected package resolution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This script also uses npx tsx, which may execute a package resolved at runtime instead of a strictly pinned binary from a trusted install. In CI, cron, or agent-managed environments, that creates an avoidable supply-chain execution path if dependency resolution is tampered with or not locked down.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

Using npx tsx for the JSON mode retains the same risk: a tool may be fetched or resolved dynamically at execution time. For an agent skill that may be run automatically, executing developer tooling through npx increases exposure to dependency confusion or compromised package delivery.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The cron-oriented script is more sensitive because it is likely to run unattended on a schedule. If npx tsx resolves an unexpected package or version in that environment, an attacker could gain code execution repeatedly and without user interaction.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The login script uses npx tsx, and because it likely handles authentication flows, compromise of the runtime tool could expose credentials, session cookies, or browser automation secrets. Dynamic package execution is especially risky in scripts that interact with third-party accounts.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The shebang uses npx tsx without pinning a specific version, so execution may fetch or resolve an unexpected package version at runtime. In environments that do not have tsx already installed and locked, this creates supply-chain risk and reduces reproducibility, potentially allowing malicious or compromised upstream code to run when the script is invoked.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The usage example instructs users to run npx tsx without a pinned version, which can cause ad hoc installation or resolution of whatever version is current at execution time. That exposes users to dependency confusion or upstream package compromise and makes behavior non-deterministic across systems.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

This command example repeats the unpinned npx tsx pattern, encouraging runtime retrieval or resolution of an unspecified package version. If the package registry or dependency chain is compromised, a user following this command could execute attacker-controlled code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The documented --json invocation still relies on unpinned npx tsx, preserving the same supply-chain and reproducibility risks. Even though this is a comment, it directly influences how operators will execute the script, so it has practical security impact.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

This cron-mode example promotes use of an unpinned npx tsx command, which is especially risky in automation because scheduled tasks may repeatedly resolve or execute a compromised package version. In an agent/alerting context, cron execution can provide persistent and unattended opportunities for malicious code execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The forced cron example again uses unpinned npx tsx, extending the same package-resolution risk to a mode intended for unattended execution. Because this skill is a decision/alerting engine likely to run on schedules, the context increases the danger: exploitation could affect recurring jobs and any environment secrets or notification channels available to the process.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.