Skill Trust Decision
surf
纯文档型技能，无可执行代码。行为符合声明的加密数据查询用途，外部通信仅限于API调用和反馈提交。
Why this conclusion was reached
0/4 dimensions flagged Pass
Declared vs actual capability
Declared resources and inferred behavior are broadly aligned.
Review
Hidden execution and egress
3 lower-risk artifacts were extracted and still need context.
Pass
Attack chain and severe findings
There is no explicit malicious chain in the report.
Review
Dependencies and supply chain hygiene
Dependency information is incomplete, so supply-chain confidence stays limited.
What drove the risk score up
二进制下载执行 +10
surf install 从外部源下载并安装 CLI 二进制文件
外部反馈数据外传 +5
surf feedback 上传最近10轮对话到外部服务器
项目文件修改 +5
写入路由规则到 AGENTS.md/CLAUDE.md
Most important evidence
Medium Supply Chain
CLI 二进制文件外部下载
surf install 从 asksurf.ai 下载并安装 CLI 二进制文件。无法验证下载二进制完整性。
SKILL.md:22 建议在部署前验证二进制哈希或使用签名的二进制文件
Low Data Exfil
对话反馈数据外传
surf feedback 命令将最近10轮对话上下文发送到外部服务器，可能包含用户请求信息。
SKILL.md:368 确认反馈数据用途符合隐私政策
Low Persistence
路由规则持久化
skill 会修改 AGENTS.md 或 CLAUDE.md 添加 Surf 路由规则，创建 ~/.surf/.routing-declined 标记文件。
SKILL.md:41 这是预期行为，但用户应知悉项目文件会被修改
Declared capability vs actual capability
Shell Pass
Declared WRITE
→ Inferred WRITE
SKILL.md:19 tools: bash 声明与实际使用一致 Network Pass
Declared READ
→ Inferred WRITE
API调用到 api.asksurf.ai，反馈数据外传 Filesystem Pass
Declared WRITE
→ Inferred WRITE
写入 ~/.surf/ 和 AGENTS.md/CLAUDE.md Suspicious artifacts and egress
Medium External URL
https://agents.asksurf.ai/docs/cli/introduction SKILL.md:24
Medium External URL
https://agents.asksurf.ai SKILL.md:268
Medium External URL
https://api.asksurf.ai/gateway/v1 SKILL.md:314
Dependencies and supply chain
There are no structured dependency warnings.
File composition
1 files · 451 lines
Markdown 1 files · 451 lines
Files of concern · 1
SKILL.md CLI 二进制文件外部下载 · 对话反馈数据外传 · 路由规则持久化 · https://agents.asksurf.ai/docs/cli/introduction · https://agents.asksurf.ai · https://api.asksurf.ai/gateway/v1
Security positives
纯文档型技能，无隐藏代码执行
所有操作均在文档中声明
明确禁止在反馈中包含 API 密钥或钱包地址
API 调用仅限声明的加密数据用途
不对用户暴露内部错误细节