Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Magic card lookup helper that calls the public Scryfall API and does not show hidden, persistent, credential, or destructive behavior.
Install this if you want an agent to query Scryfall for Magic card information. Be aware that your card searches may be sent to Scryfall, and the trigger wording may cause the skill to activate for broad MTG-related prompts.
The skill documents outbound network access to the Scryfall API but does not declare any explicit tool scope or permissions boundary. That creates an authorization gap where the runtime may permit broader-than-intended network behavior or make review/auditing of external access harder, increasing the chance of unintended data egress or misuse of network capabilities.
The manifest description says to use the skill whenever the user asks about MTG cards and lists broad triggers such as mentions of 'MTG', 'Magic', deck building questions, requests for card information, or any card attribute. This lacks clear boundaries or exclusion conditions, increasing the chance of unintended invocation in general conversations where those terms appear incidentally.
No suspicious patterns detected.
