Surf Check

• Analyzed: May 12, 2026, 4:26 AM
• Findings: 0
• Version: 0.2.2
• Hash: 5ded251c2e34d4717b7d65f906908e654972b71acfe00c71f28dd6c9963337ce
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: surf-check Version: 0.2.2 The OpenClaw AgentSkills skill bundle 'surf-check' is classified as benign. The skill's primary function is to fetch and evaluate surf forecasts from Surfline and NOAA. It handles user-provided Surfline credentials (email and password, declared as 'secret' in SKILL.md) and stores session cookies in its local `data/session/cookies.json` directory to access premium features. This sensitive data handling is explicitly declared and necessary for the skill's stated purpose, not for unauthorized exfiltration. All file system operations, such as managing `data/state.json` and `data/session/cookies.json`, are confined to the skill's own directories or user-specific configuration files (`~/.surf-check.json`). Network calls are exclusively to legitimate Surfline and NOAA endpoints. The `SKILL.md` and `README.md` provide clear, non-malicious instructions for the AI agent and users, with no evidence of prompt injection attempts to subvert agent behavior or access unrelated sensitive data. The use of Playwright is justified for automated login to Surfline.