Manage Basecamp (via bc3 API / 37signals Launchpad) projects, to-dos, messages, and campfires via a TypeScript CLI. Use when you want to list/create/update Basecamp projects and todos from the terminal, or when integrating Basecamp automation into Clawdbot workflows.

What to check before installing: - Verify the package publisher and source: package.json points to a GitHub repo (emredoganer/basecamp-cli). Visit that repo and confirm it matches the code here and is maintained by a trusted author. The skill metadata (registry) failing to declare required env vars is suspicious—don't trust the registry entry alone. - Confirm credential handling: the README/SKILL.md ask you to set BASECAMP_CLIENT_SECRET in your shell. Inspect src/lib/config.ts and src/lib/auth.ts in the repo to confirm the secret is not written to disk and to see how access tokens are persisted (the code likely uses the 'conf' package). Prefer using a short-lived OAuth flow or an access token with limited scope if possible. - If you will install globally (npm -g), be aware the CLI will run on your machine and can access anything your user account can. Only install if you trust the package and author. - If you are especially cautious: run the CLI in a disposable environment (container or dedicated VM), or audit the compiled/dist files before granting credentials. - If you maintain automated tooling that checks skill metadata, update the registry entry or ask the publisher to declare required env vars (BASECAMP_CLIENT_ID, BASECAMP_CLIENT_SECRET, optional BASECAMP_ACCESS_TOKEN) so permission prompts are accurate. Confidence note: I reviewed the SKILL.md, README, package.json and many command files; some lib files were truncated in the provided bundle so I could not fully verify exact token storage logic—inspect src/lib/config.ts and src/lib/auth.ts to raise confidence to high.

Type: OpenClaw Skill Name: basecamp-cli Version: 1.0.0 The OpenClaw AgentSkills skill bundle for the Basecamp CLI is benign. It provides a command-line interface to manage Basecamp resources, using standard and secure practices for OAuth 2.0 authentication, including PKCE and a local redirect server. Sensitive tokens are encrypted on disk using a machine-specific key, and the `BASECAMP_CLIENT_SECRET` is explicitly required to be set as an environment variable, never stored in configuration files. The `SKILL.md` and `README.md` contain clear, functional instructions without any evidence of prompt injection attempts or hidden directives. All network communication is directed to legitimate Basecamp API endpoints (`launchpad.37signals.com`, `3.basecampapi.com`).