F1 CLI

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: f1-cli Version: 1.0.1 The f1-cli skill is a legitimate tool designed to query Formula 1 data from the OpenF1 API. The SKILL.md file provides standard installation instructions via Homebrew and Go, along with comprehensive documentation for retrieving race results, telemetry, and standings. No indicators of data exfiltration, malicious execution, or prompt injection were found.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the CLI may run code from an external package source that is outside this artifact review.

Why it was flagged

The skill depends on an externally installed CLI and the Go install option uses @latest, so the reviewed artifact does not pin the exact code version users would install.

Skill content

brew tap barronlroth/tap
brew install f1-cli
...
go install github.com/barronlroth/f1-cli/cmd/f1@latest

Recommendation

Verify the f1-cli repository or Homebrew tap before installing, and prefer a pinned or trusted release when possible.

Note

ASI02: Tool Misuse and Exploitation

What this means

Broad telemetry or location queries could be slow or produce large outputs, even when a display limit is used.

Why it was flagged

The skill exposes command-line API queries, including raw filters and potentially large result retrieval, but this is disclosed and directly related to F1 data analysis.

Skill content

`--filter EXPR` | Raw API filter, repeatable ...
...
`--limit` is client-side only. The OpenF1 API does not support a `limit` query parameter. The CLI fetches all results then truncates locally.

Recommendation

Use server-side filters and session/driver constraints for large F1 data requests.