pp-surfline

Pass

Audited by Gen Agent Trust Hub on Aug 10, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the surfline-pp-cli tool using npx from the author's NPM package (@mvanhorn/printing-press-library) or via go install from the author's GitHub repository (github.com/mvanhorn/printing-press-library). These are recognized as vendor-owned resources.
  • [REMOTE_CODE_EXECUTION]: The skill facilitates the download and execution of the CLI binary via npx and go install patterns. These installation methods are standard for the provided developer tools and originate from the vendor's own infrastructure.
  • [COMMAND_EXECUTION]: The skill operates by executing shell commands using the surfline-pp-cli binary to interact with the Surfline API and manage local SQLite storage for surf spots and alerts.
  • [DATA_EXFILTRATION]: The CLI provides a --deliver webhook:<url> feature that allows output to be POSTed to an external URL. It also supports sending feedback to a destination defined by SURFLINE_FEEDBACK_ENDPOINT. These are documented features for data routing and user feedback that require explicit configuration or flags.
  • [CREDENTIALS_UNSAFE]: The skill handles Surfline authentication tokens via auth login and environment variables (SURFLINE_ACCESS_TOKEN). It follows standard local credential management practices for CLI applications.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 10, 2026, 08:22 AM
Security Audit — agent-trust-hub — pp-surfline