Skills
Navigate
skills/sendaifun/skills/surfpool/Gen Agent Trust Hub

surfpool

Fail

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill documents an automated installation method that pipes a remote script directly into a shell interpreter.
  • Evidence: curl -sL https://run.surfpool.run/ | bash is featured across multiple files including SKILL.md, resources/cli-reference.md, resources/github-repos.md, and docs/troubleshooting.md as the recommended installation path.
  • Risk: Downloading and executing untrusted scripts directly from remote servers can lead to arbitrary code execution if the domain or transport layer is compromised.
  • [EXTERNAL_DOWNLOADS]: The documentation references multiple third-party hosted distribution channels and external network repositories.
  • Evidence: References to a Homebrew tap (txtx/taps/surfpool), a Docker Hub image (surfpool/surfpool), and Cargo crates (surfpool-cli, surfpool-core).
  • Risk: Introduces external dependencies and supply chain risks through reliance on third-party infrastructure.
Recommendations
  • HIGH: Downloads and executes remote code from: https://run.surfpool.run/ - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 14, 2026, 10:07 PM
Security Audit — agent-trust-hub — surfpool