Surfline (public)

Get surf forecasts and current conditions from Surfline public endpoints (no login). Use to look up Surfline spot IDs, fetch forecasts/conditions for specific spots, and summarize multiple favorite spots.

Security Scan

The skill is internally consistent with its description: it calls Surfline public endpoints, needs no credentials, and only reads/writes expected user config/cache files.

Purpose & Capability

Name/description say 'public Surfline endpoints (no login)' and the code exclusively queries https://services.surfline.com endpoints (search, kbyg/*). The provided search, report, and favorites functionality matches the claimed purpose.

Instruction Scope

SKILL.md instructs running the included Python scripts. The scripts only perform HTTP GETs to Surfline, parse JSON, and output summaries/JSON. They also read a user favorites config (~/.config/surfline/favorites.json) and write/read a cache (~/.cache/surfline by default), which is documented in the README; this is within the skill's stated scope.

Install Mechanism

There is no install spec (instruction-only), and the Python scripts use only the standard library. One mismatch: registry metadata lists no required binaries but SKILL.md commands assume python3 is available. That is minor (standard expectation) but worth noting.

Credentials

The skill declares no required env vars or credentials. The code does read optional env vars SURFLINE_CACHE_DIR and SURFLINE_CACHE_TTL_SEC (non-sensitive, control cache location/TTL) and otherwise accesses user files under the home directory (favorites config and cache). These accesses are proportional to the feature and documented in SKILL.md.

Persistence & Privilege

always: false and no special persistence requested. The skill creates and uses its own cache/config paths and does not attempt to modify other skills or system-wide settings.

Assessment

This skill appears to do what it claims: query Surfline public endpoints and summarize results. Before installing, note: (1) the author is unknown — if you need stronger assurance, review the included Python files yourself; (2) it requires python3 at runtime (not declared in registry metadata); (3) it will read ~/.config/surfline/favorites.json (if you use favorites) and create/read cache files under ~/.cache/surfline by default — you can set SURFLINE_CACHE_DIR and SURFLINE_CACHE_TTL_SEC to control this; (4) it uses the network to contact services.surfline.com and sets a custom User-Agent; (5) run in a sandbox if you prefer, but no credentials or secrets are requested and there is no suspicious or obfuscated behavior in the code.

Surfline (public, no login)

This skill uses Surfline public endpoints (no account, no cookies).

Quick start

1. Find a spot id:

python3 scripts/surfline_search.py "Cardiff Reef"
python3 scripts/surfline_search.py "D Street"

2. Get a report for a spot id (prints text + JSON by default):

python3 scripts/surfline_report.py <spotId>
# or only one format:
python3 scripts/surfline_report.py <spotId> --text
python3 scripts/surfline_report.py <spotId> --json

3. Favorites summary (multiple spots) (prints text + JSON by default):

Create ~/.config/surfline/favorites.json (see references/favorites.json.example).

python3 scripts/surfline_favorites.py

Notes

• Keep requests gentle: don’t hammer endpoints. Scripts include basic caching.
• Spot IDs are stable; store them once.
• If Surfline changes endpoints/fields, update scripts/surfline_client.py.