Tarkov API + Wiki Hardcore Assistant

Security-focused Tarkov.dev + optional EFT Wiki operations for hardcore Escape from Tarkov players. Use when users want reliable EFT data lookups (items, pri...

This skill appears to do what it says: query api.tarkov.dev and optionally the EFT wiki, and convert results into gamer-friendly recommendations. Before installing: (1) only use --allow-unsafe-endpoint if you trust the alternate host; the script refuses non-official endpoints by default, which is good; (2) when using stash-value, only point to data files you control — do not pass paths to sensitive local files you wouldn't want included in requests or printed output; (3) it's pure Python stdlib (no third-party downloads), so review the single script if you want extra assurance; (4) if you enable autonomous agent invocation, remember the agent could call the skill and cause outbound requests (this is standard behavior). If you need higher assurance, run the script locally in a sandbox and inspect network traffic or the source before granting runtime access.

Type: OpenClaw Skill Name: tarkov-api Version: 1.0.2 The skill is classified as suspicious due to a Local File Inclusion (LFI) vulnerability in the `stash-value` command within `scripts/tarkov_api.py`. The script directly reads the file path provided by the `--items-file` argument without validation or sandboxing, allowing a prompt-injected AI agent to potentially read arbitrary files on the system (e.g., `/etc/passwd`, `~/.ssh/id_rsa`). While the skill's overall design and documentation (`SKILL.md`, `references/security-model.md`) emphasize security and explicitly forbid malicious actions like remote code execution, this LFI risk constitutes a significant vulnerability that could lead to sensitive data exposure.