Stormglass Surf & Ocean Data

Fetch surf-relevant ocean conditions from Stormglass by spot name or coordinates, including current snapshot and 1-3 day forecast windows with tides, gusts,...

This skill appears coherent with its stated purpose: it runs a Python CLI that calls Stormglass (requires STORMGLASS_API_KEY) and, if you provide it, Google Geocoding (or it falls back to OpenStreetMap). Before installing/use: 1) Be aware the registry only lists STORMGLASS_API_KEY as required—SKILL.md and the code also accept an optional GOOGLE_GEOCODING_API_KEY (so ensure any automation/exposure of credentials includes that clarification). 2) Review the bundled scripts in your environment (they will make outbound HTTPS calls to Stormglass, Google Maps, and OSM). If you want to test safely, run the included tests with --mock to avoid using keys or network. 3) Limit and rotate the Stormglass and Google keys you provide, and consider running the CLI in an isolated environment or with restricted network access if you have concerns. 4) Confirm the full surf_report.py (the file is large) matches expectations and contains no unexpected remote endpoints or hidden behavior; if you want higher assurance, run the test runner and inspect logs in a sandbox first.

Type: OpenClaw Skill Name: stormglass Version: 1.0.2 The OpenClaw AgentSkills skill bundle for Stormglass surf reports is benign. The `scripts/surf_report.py` script legitimately interacts with known external APIs (Stormglass, Google Geocoding, OpenStreetMap Nominatim) to fetch weather and tide data. API keys are securely read from environment variables, and input sanitization is handled via `argparse` and `urllib.parse.urlencode`. There is no evidence of malicious intent, such as unauthorized data exfiltration, arbitrary command execution, persistence mechanisms, or prompt injection attempts in the `SKILL.md` or other documentation files. All network calls are to documented and expected services, and the overall code structure is clean and follows best practices.