Surf Skill — One Skill, All Crypto Data

SUSPICIOUS. The skill’s crypto-data purpose mostly matches its capabilities, but its actual footprint relies on an externally installed, repeatedly updated CLI obtained via pipe-to-shell, then forwards and stores API keys in that CLI. Official Surf-owned domains reduce the chance of outright deception, yet the install trust model and credential forwarding to an unverifiable binary make this a high security-risk skill rather than a benign documentation/integration guide.