Tarkov API + Wiki Hardcore Assistant
PassAudited by ClawScan on May 1, 2026.
Overview
This appears to be a coherent Tarkov game-data helper; its main things to notice are disclosed external API/wiki calls, a user-selected stash-file input, and an expert raw-query option.
This skill looks safe for its stated Tarkov lookup purpose. Before installing, be comfortable with it contacting Tarkov.dev and the EFT Wiki, use predefined commands where possible, avoid raw or unsafe endpoints unless you review them, and only pass intended stash JSON/CSV files.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A raw query can make broader or less predictable API requests than the normal commands if the user or agent supplies an unsuitable query.
The skill exposes a raw GraphQL path, but the documentation explicitly tells users to prefer safer predefined commands and validate raw use.
Prefer predefined subcommands over `raw` mode.
Use the predefined commands for normal play; only use raw mode after reviewing the query, variables, and endpoint.
If pointed at the wrong file, the tool may read unintended local content, although the parser is designed for JSON/CSV stash item lists.
The stash valuation feature reads a user-provided local file path, which is expected for importing a stash list but should be used intentionally.
with open(path, "r", encoding="utf-8") as f:
raw = f.read().strip()Provide only a minimal stash export file with item names and counts; do not point the command at personal or unrelated files.
Game-related search terms, page titles, or stash item names used for lookups may leave the local environment.
The artifacts disclose external provider calls for API and wiki lookups, so user queries and item names may be sent to those services.
Outbound requests may contact `api.tarkov.dev` and `escapefromtarkov.fandom.com` when needed.
Avoid submitting non-game or private data as query text, and keep wiki/API calls limited to the information needed.