deck-strat

Pass

Audited by Gen Agent Trust Hub on Sep 13, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of deck lists from external sources such as Moxfield exports or plain text. This data is processed in Step 1 and used to build the strategy guide. The attack surface is mitigated by the use of structural parsing tools and validation against Scryfall's oracle data. The capability inventory includes file writes to the working directory and network fetches for card data. The skill implements a 'Rules Audit' subagent that re-verifies all claims against the official Comprehensive Rules text, acting as a secondary validation layer.
  • [EXTERNAL_DOWNLOADS]: During setup, the skill executes scripts to download MTG JSON data and the Comprehensive Rules. These downloads target established community resources for Magic: The Gathering data. The dependencies listed in pyproject.toml (click, requests) are standard libraries from the official Python package registry.
  • [DYNAMIC_EXECUTION]: In Step 10, the skill dispatches a general-purpose subagent with a specific charter to audit the generated strategy guide. The subagent is restricted to rules verification, arithmetic checks, and internal consistency, using provided card data and rules files.
  • [COMMAND_EXECUTION]: The skill uses the uv tool to manage its environment and execute various MTG utility scripts. These scripts (parse-deck, scryfall-lookup, etc.) are part of the mtg_utils package provided by the vendor and are used for domain-specific analysis of the deck content.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 13, 2026, 10:44 PM
Security Audit — agent-trust-hub — deck-strat