SeaLegs AI Marine Forecast API

PassAudited by ClawScan on May 1, 2026.

Overview

The skill appears to be a coherent SeaLegs marine forecast API integration, with expected but noteworthy use of an API key, location/vessel data, and paid forecast credits.

This skill looks consistent with its stated purpose. Before installing, make sure you are comfortable providing a SeaLegs API key, sending requested boating/location details to SeaLegs, and allowing the agent to create or refresh forecasts that spend credits. Treat AI safety classifications as advisory and verify important boating decisions with official marine forecasts and local conditions.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If an agent creates or refreshes forecasts, the user's SeaLegs credits can be reduced.

Why it was flagged

The skill documents API actions that create or refresh forecasts and consume account credits. This is core to the service and is disclosed, but it is still a credit-spending operation.

Skill content
| Create forecast | POST /v3/spotcast | 1 credit/day | ... | Refresh forecast | POST /v3/spotcast/{id}/refresh | 1 credit/day |
Recommendation

Confirm before allowing credit-consuming POST or refresh actions, especially for multi-day forecasts, and monitor the account balance.

What this means

Anyone or any agent with access to the key may be able to use the user's SeaLegs account and credits within the API's permissions.

Why it was flagged

The skill requires a SeaLegs API key and uses it as a bearer credential for all requests, which grants delegated access to the user's SeaLegs account for forecast and balance operations.

Skill content
Authorization: Bearer $SEALEGS_API_KEY
Recommendation

Store the key in a secret manager or environment variable, avoid pasting it into prompts, and rotate or revoke it if it may have been exposed.

What this means

Requested locations, dates, vessel details, and custom metadata may be shared with SeaLegs to generate forecasts.

Why it was flagged

Forecast requests send location, trip, vessel, and optional metadata fields to the SeaLegs API. This is expected for a marine forecast service, but those fields can reveal travel or boating details.

Skill content
"latitude": 25.7617, "longitude": -80.1918, ... "vessel_info": {"type": "sailboat", "length_ft": 35}
Recommendation

Only include the location and trip details needed for the forecast, and avoid putting personal or sensitive information in metadata fields.

What this means

A user could treat a GO or NO-GO label as definitive even though marine safety depends on changing local conditions and official advisories.

Why it was flagged

The skill presents AI-generated safety classifications for marine conditions. This is aligned with the stated purpose, but users may over-rely on the labels for real-world boating decisions.

Skill content
AI Safety Analysis: GO / CAUTION / NO-GO classifications for each day
Recommendation

Use the forecast as an advisory aid and cross-check official marine weather, local conditions, and personal judgment before boating.