Security audit
Security checks across malware telemetry and agentic risk
Raysurfer has a coherent code-caching purpose, but it can send task text and full source files to a third-party service and run remotely retrieved code without enough user control.
Install only if you are comfortable sending task descriptions, workflow metadata, and selected source files to Raysurfer. Avoid using it on private, regulated, customer, or secret-bearing code unless you manually inspect exactly what will be uploaded and understand Raysurfer's retention and sharing model. Treat cached and public snippets as untrusted code and review them before writing or running them.
}).encode(),
headers={"Authorization": f"Bearer {os.environ['RAYSURFER_API_KEY']}", "Content-Type": "application/json"},
)
with urllib.request.urlopen(req) as resp:
print(json.dumps(json.loads(resp.read()), indent=2))task = sys.argv[1] if len(sys.argv) > 1 else "Parse a CSV file and generate a bar chart"
req = urllib.request.Request(
"https://api.raysurfer.com/api/retrieve/search",
data=json.dumps({"task": task, "top_k": 5, "min_verdict_score": 0.3}).encode(),
headers={"Authorization": f"Bearer {os.environ['RAYSURFER_API_KEY']}", "Content-Type": "application/json"},
)#!/usr/bin/env bash
# Search Raysurfer cache. Usage: bash search.sh "task description"
TASK="${1:-Parse a CSV file and generate a bar chart}"
curl -s -X POST https://api.raysurfer.com/api/retrieve/search \
-H "Authorization: Bearer $RAYSURFER_API_KEY" \
-H "Content-Type: application/json" \
-d "{\"task\": \"$TASK\", \"top_k\": 5, \"min_verdict_score\": 0.3}" | python3 -m json.tool 2>/dev/null#!/usr/bin/env bash
# Search Raysurfer cache. Usage: bash search.sh "task description"
TASK="${1:-Parse a CSV file and generate a bar chart}"
curl -s -X POST https://api.raysurfer.com/api/retrieve/search \
-H "Authorization: Bearer $RAYSURFER_API_KEY" \
-H "Content-Type: application/json" \
-d "{\"task\": \"$TASK\", \"top_k\": 5, \"min_verdict_score\": 0.3}" | python3 -m json.tool 2>/dev/null// Search Raysurfer cache. Usage: bun search.ts "task description"
const task = process.argv[2] ?? "Parse a CSV file and generate a bar chart";
const resp = await fetch("https://api.raysurfer.com/api/retrieve/search", {
method: "POST",
headers: { Authorization: `Bearer ${process.env.RAYSURFER_API_KEY}`, "Content-Type": "application/json" },
body: JSON.stringify({ task, top_k: 5, min_verdict_score: 0.3 }),// Search Raysurfer cache. Usage: bun search.ts "task description"
const task = process.argv[2] ?? "Parse a CSV file and generate a bar chart";
const resp = await fetch("https://api.raysurfer.com/api/retrieve/search", {
method: "POST",
headers: { Authorization: `Bearer ${process.env.RAYSURFER_API_KEY}`, "Content-Type": "application/json" },
body: JSON.stringify({ task, top_k: 5, min_verdict_score: 0.3 }),task, filepath = sys.argv[1], sys.argv[2]
content = open(filepath).read()
req = urllib.request.Request(
"https://api.raysurfer.com/api/store/execution-result",
data=json.dumps({
"task": task,
"file_written": {"path": os.path.basename(filepath), "content": content},TASK="${1:?Usage: upload.sh <task> <file>}"
FILE="${2:?Usage: upload.sh <task> <file>}"
CONTENT=$(cat "$FILE" | python3 -c "import sys,json; print(json.dumps(sys.stdin.read()))")
curl -s -X POST https://api.raysurfer.com/api/store/execution-result \
-H "Authorization: Bearer $RAYSURFER_API_KEY" \
-H "Content-Type: application/json" \
-d "{\"task\": \"$TASK\", \"file_written\": {\"path\": \"$(basename "$FILE")\", \"content\": $CONTENT}, \"succeeded\": true, \"auto_vote\": true}" | python3 -m json.tool 2>/dev/nullTASK="${1:?Usage: upload.sh <task> <file>}"
FILE="${2:?Usage: upload.sh <task> <file>}"
CONTENT=$(cat "$FILE" | python3 -c "import sys,json; print(json.dumps(sys.stdin.read()))")
curl -s -X POST https://api.raysurfer.com/api/store/execution-result \
-H "Authorization: Bearer $RAYSURFER_API_KEY" \
-H "Content-Type: application/json" \
-d "{\"task\": \"$TASK\", \"file_written\": {\"path\": \"$(basename "$FILE")\", \"content\": $CONTENT}, \"succeeded\": true, \"auto_vote\": true}" | python3 -m json.tool 2>/dev/nullconst [task, filepath] = [process.argv[2], process.argv[3]];
if (!task || !filepath) { console.error("Usage: bun upload.ts <task> <file>"); process.exit(1); }
const content = readFileSync(filepath, "utf-8");
const resp = await fetch("https://api.raysurfer.com/api/store/execution-result", {
method: "POST",
headers: { Authorization: `Bearer ${process.env.RAYSURFER_API_KEY}`, "Content-Type": "application/json" },
body: JSON.stringify({ task, file_written: { path: basename(filepath), content }, succeeded: true, auto_vote: true }),65/65 vendors flagged this skill as clean.
Detected: suspicious.env_credential_access