Antfarm Cli

PassAudited by ClawScan on May 10, 2026.

Overview

This is a coherent Antfarm CLI command guide, but it delegates to a local Antfarm program that was not included for review, so users should verify that program before using install or run commands.

This skill appears benign as an instruction-only wrapper for Antfarm CLI commands. Before installing, make sure the referenced Antfarm CLI exists at the stated path and comes from a trusted source, and approve workflow installation, workflow execution, and dashboard startup commands intentionally.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

If the local Antfarm CLI at that path is missing, outdated, or replaced, the agent would run whatever code is present there.

Why it was flagged

The skill relies on a local Antfarm CLI executable that is not included in the provided skill files. This is coherent for an instruction-only CLI helper, but the executable's provenance and behavior cannot be reviewed from these artifacts.

Skill content

Always use full path: `node ~/.openclaw/workspace/antfarm/dist/cli/cli.js`

Recommendation

Verify that the Antfarm CLI at the referenced path is installed from a trusted source before invoking this skill.

Low

#ASI05: Unexpected Code Execution

What this means

Running workflows may execute actions defined outside this skill package.

Why it was flagged

The skill instructs the agent to execute a local Node.js CLI. Local command execution is expected for this CLI-focused skill, but the actual runtime behavior depends on the external Antfarm CLI and installed workflows.

Skill content

node ~/.openclaw/workspace/antfarm/dist/cli/cli.js workflow run <workflow-id> "<task>"

Recommendation

Use trusted workflow IDs and review the task being passed to the workflow before running it.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The agent could modify Antfarm's local workflow setup or start a dashboard when asked to use those commands.

Why it was flagged

The documented commands can install workflows, run workflows, and start a dashboard. These actions are aligned with the stated purpose, but they can change local workflow state or start a service.

Skill content

workflow install <name> ... workflow run <workflow-id> "<task>" ... dashboard start

Recommendation

Confirm install, run, and dashboard-start actions before execution, especially for unfamiliar workflows.