Toingg Ops Toolkit

Create and launch Toingg voice-calling campaigns by POSTing user-supplied JSON to the toingg/make_campaign API. Use when Codex needs to turn campaign briefs...

This toolkit appears to do what it says, but take these precautions before installing or enabling scheduled runs: (1) Treat TOINGG_API_TOKEN as sensitive — do not commit it to source control; instead use secure secret storage or the platform's recommended secret mechanism. Note the skill metadata does not declare this required env var — ask the publisher to update it. (2) Avoid storing contact lists, campaign payloads, or analytics snapshots in public or shared repositories; they contain PII. (3) If you enable the recommended cron, verify where the cron runs and how the gateway exposes environment variables (rotate the token after enabling and restrict its permissions if possible). (4) Confirm the external API domain (https://prepodapi.toingg.com) is the legitimate endpoint you expect. (5) If you need stronger assurance, run the scripts locally against test data first, inspect network calls, and only grant the token to environments you control. The main concrete red flag is the metadata mismatch (missing required env var); ask the skill author to fix that before broad deployment.

Type: OpenClaw Skill Name: toingg-create-campaign Version: 1.1.0 The skill bundle is designed to manage Toingg campaigns, involving API interactions, local file processing (Excel to JSON), and optional cron job setup for analytics. All Python scripts communicate with a single, consistent Toingg API endpoint and retrieve the API token from environment variables, which is standard practice. The `SKILL.md` and `references/*.md` files provide clear, task-oriented instructions to the AI agent, including shell commands for running scripts, creating directories, and setting up cron jobs with `date` command substitution. There is no evidence of intentional malicious behavior such as data exfiltration to unauthorized endpoints, hidden backdoors, or deceptive prompt injection against the agent. All actions, while involving powerful capabilities like shell execution and file I/O, are directly aligned with the stated purpose of the skill.