pp-surfline
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the
surfline-pp-clitool usingnpxfrom the author's NPM package (@mvanhorn/printing-press-library) or viago installfrom the author's GitHub repository (github.com/mvanhorn/printing-press-library). These are recognized as vendor-owned resources. - [REMOTE_CODE_EXECUTION]: The skill facilitates the download and execution of the CLI binary via
npxandgo installpatterns. These installation methods are standard for the provided developer tools and originate from the vendor's own infrastructure. - [COMMAND_EXECUTION]: The skill operates by executing shell commands using the
surfline-pp-clibinary to interact with the Surfline API and manage local SQLite storage for surf spots and alerts. - [DATA_EXFILTRATION]: The CLI provides a
--deliver webhook:<url>feature that allows output to be POSTed to an external URL. It also supports sending feedback to a destination defined bySURFLINE_FEEDBACK_ENDPOINT. These are documented features for data routing and user feedback that require explicit configuration or flags. - [CREDENTIALS_UNSAFE]: The skill handles Surfline authentication tokens via
auth loginand environment variables (SURFLINE_ACCESS_TOKEN). It follows standard local credential management practices for CLI applications.
Audit Metadata