The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions utilize local shell commands to manage its backend server and maintain the reasoning loop.
Evidence: SKILL.md contains commands to run uv run download-mtgjson, uv run deck-forge, and background curl heartbeat loops targeting 127.0.0.1.
[DYNAMIC_EXECUTION]: The background reasoning loop executes arbitrary Python snippets via python -c for polling and posting data between the human-facing UI and the AI agent.
Evidence: SKILL.md specifies loops using uv run python -c "import requests,json; ..." to communicate with the local FastAPI hub.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-imported deck lists and external card metadata, which could serve as a vector for indirect instructions if not properly sanitized.
Ingestion points: Untrusted content enters the context via frontend/src/components/ImportDialog.svelte (pasted deck lists or uploaded files) and the polling of card data in SKILL.md.
Boundary markers: While the agent is told to ground answers in real oracle text and searches, the skill lacks explicit markers or instructions to ignore embedded commands in imported text.
Capability inventory: The agent can execute local commands via uv run and invoke other skills (/deck-strat, /lgs-search) using the Skill tool.
Sanitization: Input is parsed by a 'Deterministic core' backend, which validates content against MTG card data, though this is primarily for functionality rather than security filtering.
[EXTERNAL_DOWNLOADS]: The skill downloads required game assets and metadata from well-known community domains.
Evidence: Fetches MTGJSON data files and retrieves card imagery and symbols from Scryfall's official domains (scryfall.io, svgs.scryfall.io).
[UNVERIFIABLE_DEPENDENCIES]: The project includes dependencies with suspicious naming conventions that imitation popular libraries but use unconventional versioning.
Evidence: pyproject.toml and uv.lock reference httpx2 (v2.4.0) and httpcore2, which mimic the standard httpx and httpcore libraries. These packages are futuristic-dated (2026) and mimicry-named, which are common indicators of typosquatting or malicious forks.

deck-forge