Raysurfer Code Caching

What to check before installing/using this skill: - The SKILL.md and scripts require RAYSURFER_API_KEY even though the registry lists no required env vars — do not set a privileged or organization-wide API key until you confirm what the key can access. - This skill will POST full file contents to https://api.raysurfer.com for uploads and may upload code from the conversation if invoked with the `upload` argument — avoid uploading proprietary, secret, or regulated code. Prefer using a restricted test key or disabling uploads until you audit it. - Confirm the service (api.raysurfer.com) is the legitimate endpoint and review Raysurfer's privacy/security policy and retention rules (how long uploaded code is stored, who can access it, whether it is shared/public). - If you plan to use it, require explicit user confirmation before any upload: modify the skill so the agent prompts and shows the exact file contents that will be uploaded rather than uploading automatically. - Fix the metadata: the skill should declare RAYSURFER_API_KEY as a required environment variable/primary credential so policy/permission tooling can surface it to admins. - Consider removing or disabling the "public snippets" header option if you want to avoid license/copyright issues, and prefer reviewing matched code before writing it to disk. If you cannot verify the endpoint, data retention, and appropriate API key scope, treat this skill as higher-risk and do not use it with sensitive code.