rules-lawyer
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches official Magic: The Gathering Comprehensive Rules (TXT) and MTGJSON bulk data from remote sources. These resources are well-known community and official endpoints for game metadata.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data (MTG rules and card rulings) which constitutes an ingestion surface for potentially untrusted content.
- Ingestion points: Content is ingested into the agent context via
rules-lookupandrulings-lookuptools inSKILL.md. - Boundary markers: The skill includes strong instructional constraints ("The Iron Rule") requiring the agent to cite specific rule numbers and provide verbatim quotes, which acts as a structural boundary.
- Capability inventory: The agent has access to
Bashfor CLI operations,Agentfor spawning sub-agents, and standardRead/Writetools. - Sanitization: No explicit sanitization of the downloaded rules text is performed before it is read into the context.
- [DYNAMIC_EXECUTION]: Employs the
Agenttool to delegate complex rules reasoning to specialized sub-agents. These sub-agents are pre-loaded with specific slices of the Comprehensive Rules text extracted viaReadandgrepoperations. - [COMMAND_EXECUTION]: Utilizes CLI tools (
rules-lookup,rulings-lookup,download-rules) to interact with the local environment and manage rules data. These tools are part of the internalmtg_utilspackage mentioned in the compatibility requirements.
Audit Metadata