deck-wizard
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes commands to download external resources:
download-mtgjson: Fetches card data from the community MTGJSON project.download-rules: Fetches the Magic: The Gathering Comprehensive Rules.playtest-install-phase: Downloads a binary required for the playtesting simulation module.- [COMMAND_EXECUTION]: The skill relies on the execution of specialized CLI tools via
uv runfor its core operations, includingparse-deck,scryfall-lookup, anddeck-tune. - [INDIRECT_PROMPT_INJECTION]: The skill has a significant data ingestion surface:
- Parses untrusted deck lists from Moxfield, MTGO, and Arena.
- Ingests collection data from user-provided CSV files.
- Fetches and processes strategy content from external websites via
web-fetch. - Sanitization: The 'Iron Rule' mandates using official oracle text from Scryfall to override any potential instructions in training or input data.
Audit Metadata