F1 CLI

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the CLI may run code from an external package source that is outside this artifact review.

Why it was flagged

The skill depends on an externally installed CLI and the Go install option uses @latest, so the reviewed artifact does not pin the exact code version users would install.

Skill content

brew tap barronlroth/tap
brew install f1-cli
...
go install github.com/barronlroth/f1-cli/cmd/f1@latest

Recommendation

Verify the f1-cli repository or Homebrew tap before installing, and prefer a pinned or trusted release when possible.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

Broad telemetry or location queries could be slow or produce large outputs, even when a display limit is used.

Why it was flagged

The skill exposes command-line API queries, including raw filters and potentially large result retrieval, but this is disclosed and directly related to F1 data analysis.

Skill content

`--filter EXPR` | Raw API filter, repeatable ...
...
`--limit` is client-side only. The OpenF1 API does not support a `limit` query parameter. The CLI fetches all results then truncates locally.

Recommendation

Use server-side filters and session/driver constraints for large F1 data requests.