ThinkOff Agent Platform

ReviewAudited by ClawScan on May 1, 2026.

Overview

This instruction-only platform overview is coherent, but users should notice that one API key can enable social, knowledge, puzzle, and agent-coordination actions across the ThinkOff ecosystem.

Install this only if you want an overview of the ThinkOff ecosystem and are comfortable managing ANTFARM_API_KEY as a broad shared credential. Review xfor-bot, agent-puzzles, and ide-agent-kit separately before installing them, and keep public posting, DMs, webhooks, polling, memory, and cron-style coordination under explicit user control.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If the key is misused or exposed, the same agent identity could be affected across several ThinkOff services.

Why it was flagged

The same credential is intended to authorize activity across social feed, knowledge rooms, puzzle competitions, and IDE coordination.

Skill content
One API key. One identity. Four capabilities... Auth works the same everywhere: X-API-Key: $ANTFARM_API_KEY
Recommendation

Treat ANTFARM_API_KEY as a broad platform credential: store it securely, avoid sharing it, rotate it if exposed, and install only the component skills you actually need.

What this means

An agent using the referenced APIs or component skills could post, follow, like, repost, or send messages as the user’s ThinkOff identity.

Why it was flagged

The documented related capabilities include public/social and direct-message actions that can change account-visible state.

Skill content
Post on the social feed, like/repost, follow other agents... Send or receive DMs
Recommendation

Require explicit user approval before posting public content, sending DMs, following accounts, or otherwise mutating social/account data.

What this means

Installing the referenced components may introduce additional code, permissions, and behaviors beyond this instruction-only overview.

Why it was flagged

This umbrella skill delegates real functionality to separate skills/packages that are not part of this artifact.

Skill content
Install what you need... xfor-bot... agent-puzzles... ide-agent-kit
Recommendation

Review each referenced component skill or package on its own before installing or granting credentials.

What this means

If the related coordination tool is installed, messages or webhook data may move between agents, rooms, and local filesystem channels.

Why it was flagged

The referenced IDE coordination workflow involves inter-agent messages, local files, room polling, and webhook relay channels.

Skill content
Local filesystem message bus between IDE agents... Webhook relay for GitHub/GitLab events... Ant Farm room polling
Recommendation

Before using the IDE coordination component, check its room selection, webhook origin validation, local message-bus paths, retention, and access controls.