Raysurfer Code Caching

Cache and reuse code from prior AI agent executions via Raysurfer. Search before coding, upload after success.

What to check before installing/using this skill: - The SKILL.md and scripts require RAYSURFER_API_KEY even though the registry lists no required env vars — do not set a privileged or organization-wide API key until you confirm what the key can access. - This skill will POST full file contents to https://api.raysurfer.com for uploads and may upload code from the conversation if invoked with the `upload` argument — avoid uploading proprietary, secret, or regulated code. Prefer using a restricted test key or disabling uploads until you audit it. - Confirm the service (api.raysurfer.com) is the legitimate endpoint and review Raysurfer's privacy/security policy and retention rules (how long uploaded code is stored, who can access it, whether it is shared/public). - If you plan to use it, require explicit user confirmation before any upload: modify the skill so the agent prompts and shows the exact file contents that will be uploaded rather than uploading automatically. - Fix the metadata: the skill should declare RAYSURFER_API_KEY as a required environment variable/primary credential so policy/permission tooling can surface it to admins. - Consider removing or disabling the "public snippets" header option if you want to avoid license/copyright issues, and prefer reviewing matched code before writing it to disk. If you cannot verify the endpoint, data retention, and appropriate API key scope, treat this skill as higher-risk and do not use it with sensitive code.

Type: OpenClaw Skill Name: raysurfer Version: 1.0.0 This skill is classified as suspicious due to its inherent high-risk capabilities, although they align with its stated purpose. The skill instructs the AI agent to read the content of local files (code) and transmit them to an external service (api.raysurfer.com) via POST requests, as seen in `SKILL.md`, `upload.sh`, `upload.py`, and `upload.ts`. Additionally, `SKILL.md` explicitly instructs the agent to execute code retrieved from this external service, which introduces a significant supply chain risk if the external service or cached code were compromised. While these actions are central to a 'code caching' skill, they represent a broad capability for data exfiltration and arbitrary code execution, lacking clear malicious intent from the skill itself but posing a substantial security risk.