Toggl CLI – Time tracking for you and your agent

Control your Toggl Track workspace via CLI to manage time entries, projects, clients, tasks, tags, workspaces, and user profiles with flexible commands.

This SKILL.md appears to implement a legitimate Toggl CLI, but the metadata failed to declare the TOGGL_API_TOKEN it requires — that's an inconsistency you should understand before installing. If you consider using it: - Review the GitHub repo code yourself (or have a trusted reviewer) before running npm install/link; npm scripts can execute arbitrary code. - Prefer not to put your API token in broadly-loaded shell rc files; store secrets in a secure location and only expose them to the CLI when needed. - Be cautious about adding the token to ~/.claude/.env (it may make the token accessible to agents or tools you run). - If you don't want the agent to act on your Toggl account autonomously, ensure model-invocation is restricted or require explicit user consent when the skill runs. - Ask the publisher to update registry metadata to declare required environment variables and primary credential (TOGGL_API_TOKEN) so the skill's claims and requirements match. If you cannot or will not review the repository and are uncomfortable exposing your Toggl API token, do not install or provide the token.

Type: OpenClaw Skill Name: toggl-cli Version: 1.0.0 The skill bundle is benign. The `SKILL.md` provides clear instructions for installing and using a `toggl-cli` to interact with the legitimate Toggl Track API. It details how to set the `TOGGL_API_TOKEN` environment variable for authentication and includes `curl` examples demonstrating its use with the official `https://api.track.toggl.com` endpoint. There is no evidence of prompt injection, data exfiltration to unauthorized destinations, or other malicious activities within the provided files. The instructions are aligned with the stated purpose of managing Toggl Track data.