deck-wizard

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes commands to download external resources:
  • download-mtgjson: Fetches card data from the community MTGJSON project.
  • download-rules: Fetches the Magic: The Gathering Comprehensive Rules.
  • playtest-install-phase: Downloads a binary required for the playtesting simulation module.
  • [COMMAND_EXECUTION]: The skill relies on the execution of specialized CLI tools via uv run for its core operations, including parse-deck, scryfall-lookup, and deck-tune.
  • [INDIRECT_PROMPT_INJECTION]: The skill has a significant data ingestion surface:
  • Parses untrusted deck lists from Moxfield, MTGO, and Arena.
  • Ingests collection data from user-provided CSV files.
  • Fetches and processes strategy content from external websites via web-fetch.
  • Sanitization: The 'Iron Rule' mandates using official oracle text from Scryfall to override any potential instructions in training or input data.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 03:25 AM
Security Audit — agent-trust-hub — deck-wizard