Skillv1.0.0

ClawScan security

scryfall-cards · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignFeb 11, 2026, 9:03 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This skill is internally consistent: it queries the public Scryfall API for Magic: The Gathering card data, requires no credentials or installs, and its instructions and included script match the stated purpose.
Guidance: This skill appears safe and does exactly what it claims: it issues HTTP requests to the Scryfall public API and formats results. Before installing, consider: (1) the source is 'unknown' — review the included scripts yourself if you plan to run them locally; (2) the script will make outbound network requests to api.scryfall.com (no credentials are sent), so if you need to limit network egress run it in a sandbox; (3) if you want tighter control, inspect the Python file for any changes and ensure Python and requests/urllib behavior are acceptable in your environment. If you only need read-only card lookups, no secrets or special permissions are required.

Purpose & Capability: okName/description, SKILL.md, and the included Python script all describe and perform Scryfall API queries and card formatting. There are no unrelated environment variables, binaries, or services requested.
Instruction Scope: okSKILL.md instructs only how to call Scryfall endpoints, includes rate-limit guidance, and references the included script. The instructions do not ask the agent to read local secrets, system files, or send data to unexpected endpoints.
Install Mechanism: okNo install spec is provided (instruction-only), which is low risk. A helper Python script is included but would only be run by an operator; there are no downloads from third-party URLs or archive extraction steps.
Credentials: okThe skill declares no required environment variables or credentials and the code does not access secrets or config paths. Network access to api.scryfall.com is the only external dependency.
Persistence & Privilege: okThe skill is not force-included (always: false) and does not request persistent system-wide privileges or modify other skills' configurations.