Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently provides Magic: The Gathering card lookups through Scryfall, with only low-impact notes about broad triggering and network scoping.
Installers should expect this skill to make user-directed requests to Scryfall for MTG card data, including prices, images, rulings, and legality information. Consider narrowing ambiguous trigger wording and adding host-scoped permission metadata, but the inspected artifacts do not show malicious or high-impact behavior.
The skill documents outbound network use to the Scryfall API but does not declare any explicit tool scope or permissions boundary. That creates a governance gap: the runtime may permit network access more broadly than intended, making review and enforcement of least privilege harder.
The trigger description is very broad, including generic phrases like 'Magic' and wide classes of deck-building or card-information requests, which can cause the skill to activate when the user did not specifically intend it. Over-broad invocation increases the chance of unnecessary tool use and unintended network requests, though the domain here is limited to card lookups rather than a highly sensitive action.
No suspicious patterns detected.
