ClawHub

mtg-edh-deckbuilder

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Magic: The Gathering card lookup skill that sends user card queries to Scryfall and shows the results.

Install this if you want MTG card search through Scryfall. Avoid including unrelated private information in card-search prompts, and be aware that ambiguous mentions of Magic or card-like names may trigger an external Scryfall lookup.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill clearly instructs the agent to make outbound requests to the Scryfall API and includes executable command examples, yet no corresponding network permission is declared. This creates a mismatch between the skill's documented capabilities and its declared security model, which can undermine permission enforcement and user/admin expectations about external data access.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The trigger text is broad enough to activate on generic mentions of cards, games, deck building, or 'Magic,' which may cause the agent to invoke this skill in conversations where the user did not intend an external card lookup. In context, the skill is domain-specific and non-privileged beyond network access, so the main risk is over-triggering, unnecessary external requests, and mild privacy/context leakage rather than severe compromise.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal