scryfall-card
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
What this means
Card names and search queries may be sent to Scryfall when the skill is used.
Why it was flagged
The helper script sends user search terms to the Scryfall API. This is expected for the skill's purpose and uses a fixed public API host.
Skill content
BASE_URL = "https://api.scryfall.com" ... url = f"{BASE_URL}/cards/search?{params}" ... return make_request(url)Recommendation
Use normally for MTG card lookups; avoid entering unrelated private information into card search queries.