Toggl-Optimized-V2

Optimize Toggl Track usage with token-efficient API calls and fast reporting via a shell script for JSON and PDF summaries.

This skill looks like it intends to use your Toggl API token, but the registry metadata failed to declare that requirement and the included shell script is incomplete. Before installing: (1) do not provide your TOGGL_API_TOKEN to an unknown publisher without review; (2) ask the publisher for a complete script or an explanation of how PDF/JSON reports are generated and where network calls occur; (3) inspect or run the script in a safe sandbox to confirm it only calls Toggl endpoints and doesn't exfiltrate data elsewhere; (4) prefer skills that declare required env vars/credentials in metadata so automated checks can apply. If you can't verify the code or trust the author, avoid installing or limit the token's scope (rotate it after testing).

Type: OpenClaw Skill Name: toggl-optimized-v2 Version: 1.0.0 The `scripts/toggl_report.sh` file takes command-line arguments (`$1`, `$2`, `$3`, `$4`) directly without any input sanitization. While the script is incomplete and does not currently execute any commands, its stated purpose of making 'direct API v3 calls' via a 'shell script' strongly implies these unsanitized inputs would be used in subsequent `curl` or similar commands, creating a significant shell injection vulnerability risk.