Toingg Ops Toolkit

Automate Toingg ops by creating campaigns, scheduling daily analytics, converting Excel contacts, uploading lists, and sending WhatsApp template messages.

This package largely does what it says — scripts call a Toingg API and convert/upload contacts — but the published metadata failed to declare the required TOINGG_API_TOKEN and the publisher/homepage are missing. Before installing or enabling this skill: 1) Treat TOINGG_API_TOKEN as a secret; do NOT commit it to git or expose it in world-readable cron jobs. 2) Confirm the API domain (prepodapi.toingg.com) is the expected endpoint for your account. 3) If you plan to enable the analytics cron, set up the cron in an environment with only the minimal token and permissions needed. 4) Prefer to run these scripts from an isolated account/workspace and review the scripts yourself (they are small and readable). 5) Ask the publisher for provenance (who maintains the skill, a homepage or repo) or reject if you cannot verify the source. The main technical fix that would increase trust: the skill registry metadata should list TOINGG_API_TOKEN as a required credential and include publisher/contact information.

Type: OpenClaw Skill Name: toingg-skill Version: 1.0.1 The skill is classified as suspicious due to its instructions for the OpenClaw agent to create a cron job that executes a shell command. Specifically, the `references/analytics-cron.md` file contains a `openclaw cron create` command with a hardcoded absolute path (`/Users/abhinavkalvacherla/.openclaw/workspace/skills/toingg-skill`) and uses shell command substitution (`$(date +%Y%m%d)`). While these are used for a plausible purpose (scheduling analytics and timestamping files), the hardcoded path is brittle and potentially revealing, and the ability to execute arbitrary shell commands via cron represents a high-risk capability that could be exploited if the command string were influenced by untrusted input, even though no direct malicious intent is observed in this specific usage.