Surf Check

• Risk level: Low
• Analyzed: Feb 20, 2026, 7:59 PM
• Findings: 0
• Version: 0.2.2

Overview

The skill is coherent with its stated purpose: it fetches Surfline/NOAA data, evaluates surfability, writes local state/cookies, and optionally uses user Surfline credentials for premium data — nothing in the code attempts unexplained network exfiltration or access to unrelated secrets.

This skill appears to do exactly what it describes. Before installing or running it, consider: (1) It will download Node packages (Playwright) when you run npm install; Playwright can also install browser binaries if you follow README instructions. (2) If you want premium Surfline forecasts you can provide SURFLINE_EMAIL / SURFLINE_PASSWORD or run the interactive login — the login script saves session cookies to data/session/cookies.json in the skill folder, so protect that file. (3) The skill reads ~/.surf-check.json (optional) and writes state to the skill folder (data/state.json) — review and protect those files if on a multi-user system. (4) There is a small inconsistency in some script shebangs / README (tsx vs ts-node) but this is an implementation detail, not a security issue. If you are uncomfortable providing Surfline credentials to an automated script, use the interactive login flow (opens a browser) instead and review the saved cookies file afterward.