scryfall-card

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears to be a straightforward Magic: The Gathering card lookup tool that sends card search queries to the public Scryfall API.

This looks safe for its intended purpose. Before installing, understand that MTG search terms are sent to Scryfall, but the artifacts do not show credential access, local file reading, persistence, or unrelated actions.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

Card names and search queries may be sent to Scryfall when the skill is used.

Why it was flagged

The helper script sends user search terms to the Scryfall API. This is expected for the skill's purpose and uses a fixed public API host.

Skill content

BASE_URL = "https://api.scryfall.com" ... url = f"{BASE_URL}/cards/search?{params}" ... return make_request(url)

Recommendation

Use normally for MTG card lookups; avoid entering unrelated private information into card search queries.