pp-scryfall
Warn
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the
scryfall-pp-cliandscryfall-pp-mcptools from the developer's GitHub repository (github.com/mvanhorn/printing-press-library) and vianpxfrom the@mvanhorn/printing-press-librarypackage. - [DATA_EXFILTRATION]: All commands support a
--deliver webhook:<url>flag, allowing the agent to POST command results and potential system information to any specified remote URL. - [INDIRECT_PROMPT_INJECTION]: The skill implements a 'recall' and 'teach' loop where the agent processes JSON output containing 'candidates' and 'playbooks' that determine its subsequent actions.
- Ingestion points: The agent parses the output of
scryfall-pp-cli recallto find task choreography. - Boundary markers: There are no explicit instructions for the agent to treat content within the recall results as untrusted data or to ignore embedded instructions.
- Capability inventory: The agent utilizes the
Read Bashtool to execute shell commands suggested by the tool. - Sanitization: No validation or sanitization process is described for the commands extracted from the tool's output before they are executed.
- [DYNAMIC_EXECUTION]: The instructions direct the agent to 'follow each candidate's two-step next_action verbatim' and 'replay Playbook.steps in order', which involves the execution of shell commands dynamically generated and provided by the CLI's internal or remote data store.
- [COMMAND_EXECUTION]: The skill relies on local shell command execution for its core functionality, including setup verification, data retrieval, and managing a local learning database through background shell processes.
Audit Metadata