ClawHub
Back to skill

Security audit

Tarkov API + Wiki Hardcore Assistant

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Tarkov data lookup helper with bounded default endpoints and no evidence of hidden persistence, credential use, or destructive behavior.

Install only if you want an agent to make live Tarkov.dev and EFT Wiki requests and, when asked, read a stash JSON or CSV file you provide. Avoid using --allow-unsafe-endpoint unless you intentionally trust the alternate endpoint, and prefer the preset commands over raw queries for routine lookups.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Anti-Refusal Statement

High
Category
Anti-Refusal
Content
- Oversized queries causing slowdowns/timeouts
- Blind trust in unvalidated external data
- Unsafe shell interpolation from user/API data
- Excessive raw-query usage without constraints
- Overconfidence in projected profit/risk models (flip and risk scores are heuristics)
- Treating community wiki edits as authoritative without cross-check
Confidence
80% confidence
Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
## Built-in controls in `scripts/tarkov_api.py`

1. **Endpoint allowlist by default**
   - Refuses non-`api.tarkov.dev` GraphQL endpoint unless `--allow-unsafe-endpoint` is explicitly set.
   - Refuses non-official EFT wiki API endpoint unless explicitly overridden.

2. **Limit clamping**
Confidence
65% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
return endpoint
    if not endpoint.startswith(SAFE_ENDPOINT_PREFIXES):
        die(
            "Refusing unsafe endpoint. Use --allow-unsafe-endpoint only for trusted local testing."
        )
    return endpoint
Confidence
95% confidence
Finding
The allow_unsafe flag disables endpoint restrictions entirely, letting a caller redirect requests to arbitrary URLs. In an agent environment this can be abused for SSRF-like behavior, sending queries and metadata to attacker-controlled hosts, probing internal services, or bypassing the skill’s declared trust boundary.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
if allow_unsafe:
        return endpoint
    if not endpoint.startswith(SAFE_WIKI_PREFIXES):
        die("Refusing unsafe wiki endpoint. Use --allow-unsafe-endpoint only for trusted testing.")
    return endpoint
Confidence
95% confidence
Finding
The wiki endpoint safety check can also be fully bypassed with the same unsafe flag, allowing arbitrary GET requests to untrusted URLs. This broadens the attack surface beyond the intended EFT wiki and enables misuse as a generic network client in contexts where agent inputs may be attacker-influenced.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
help="Wiki API endpoint (default: escapefromtarkov.fandom.com/api.php)",
    )
    p.add_argument(
        "--allow-unsafe-endpoint",
        action="store_true",
        help="Allow non-tarkov.dev endpoint (for trusted local testing only)",
    )
Confidence
94% confidence
Finding
Exposing --allow-unsafe-endpoint at the CLI level makes the bypass readily accessible and normalizes insecure operation despite the skill’s 'secure' framing. In adversarial prompting scenarios, this flag could be invoked to turn the tool into an arbitrary outbound HTTP requester.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill advertises operational guidance that clearly involves network access, local file input, and likely environment use, but it does not declare any explicit tool scope or permissions boundary. That omission creates a governance gap: an agent may invoke broader capabilities than intended, making review, sandboxing, and least-privilege enforcement harder.

External Transmission

Medium
Category
Data Exfiltration
Content
import urllib.request
from typing import Any, Dict, List

DEFAULT_ENDPOINT = "https://api.tarkov.dev/graphql"
MAX_LIMIT = 100
SAFE_ENDPOINT_PREFIXES = (
    "https://api.tarkov.dev/graphql",
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
import urllib.request
from typing import Any, Dict, List

DEFAULT_ENDPOINT = "https://api.tarkov.dev/graphql"
MAX_LIMIT = 100
SAFE_ENDPOINT_PREFIXES = (
    "https://api.tarkov.dev/graphql",
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
import urllib.request
from typing import Any, Dict, List

DEFAULT_ENDPOINT = "https://api.tarkov.dev/graphql"
MAX_LIMIT = 100
SAFE_ENDPOINT_PREFIXES = (
    "https://api.tarkov.dev/graphql",
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
import urllib.request
from typing import Any, Dict, List

DEFAULT_ENDPOINT = "https://api.tarkov.dev/graphql"
MAX_LIMIT = 100
SAFE_ENDPOINT_PREFIXES = (
    "https://api.tarkov.dev/graphql",
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
import urllib.request
from typing import Any, Dict, List

DEFAULT_ENDPOINT = "https://api.tarkov.dev/graphql"
MAX_LIMIT = 100
SAFE_ENDPOINT_PREFIXES = (
    "https://api.tarkov.dev/graphql",
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
import urllib.request
from typing import Any, Dict, List

DEFAULT_ENDPOINT = "https://api.tarkov.dev/graphql"
MAX_LIMIT = 100
SAFE_ENDPOINT_PREFIXES = (
    "https://api.tarkov.dev/graphql",
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The raw subcommand allows callers to submit arbitrary GraphQL queries and variables to the configured endpoint, bypassing the skill’s otherwise curated operations and guardrails. In an agent/tooling context, this expands the accessible API surface and can enable unexpected data access, higher-cost queries, or use of the tool for purposes outside the declared skill boundary.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The tool markets itself as a 'secure helper' with safe controls, but the parser exposes a raw GraphQL mode and an unsafe-endpoint bypass that undermine that claim. This mismatch is security-relevant because operators or upstream agents may overtrust the tool and permit inputs they would otherwise block.

Natural-Language Policy Violations

Low
Confidence
81% confidence
Finding
This code file repeatedly sets `--lang` to `en` across multiple commands, which effectively biases output to a specific language by default. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy concern unless the locale constraint is clearly justified.

Static analysis

No suspicious patterns detected.