pp-scryfall

Warn

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the scryfall-pp-cli and scryfall-pp-mcp tools from the developer's GitHub repository (github.com/mvanhorn/printing-press-library) and via npx from the @mvanhorn/printing-press-library package.
  • [DATA_EXFILTRATION]: All commands support a --deliver webhook:<url> flag, allowing the agent to POST command results and potential system information to any specified remote URL.
  • [INDIRECT_PROMPT_INJECTION]: The skill implements a 'recall' and 'teach' loop where the agent processes JSON output containing 'candidates' and 'playbooks' that determine its subsequent actions.
  • Ingestion points: The agent parses the output of scryfall-pp-cli recall to find task choreography.
  • Boundary markers: There are no explicit instructions for the agent to treat content within the recall results as untrusted data or to ignore embedded instructions.
  • Capability inventory: The agent utilizes the Read Bash tool to execute shell commands suggested by the tool.
  • Sanitization: No validation or sanitization process is described for the commands extracted from the tool's output before they are executed.
  • [DYNAMIC_EXECUTION]: The instructions direct the agent to 'follow each candidate's two-step next_action verbatim' and 'replay Playbook.steps in order', which involves the execution of shell commands dynamically generated and provided by the CLI's internal or remote data store.
  • [COMMAND_EXECUTION]: The skill relies on local shell command execution for its core functionality, including setup verification, data retrieval, and managing a local learning database through background shell processes.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 26, 2026, 11:42 PM
Security Audit — agent-trust-hub — pp-scryfall