registry / @togglhq/cli / 1.13.147
@togglhq/cli@1.13.147
Toggl CLI for Toggl 2.0 API operations.
AI Security Review
scanned 17h ago · by lpm-firewall-aiThe flagged process and credential behavior belongs to optional CLI features and does not establish an attack chain: bundled skill setup is user-triggered and uses a local source, which the dependency excludes from repository telemetry. The package documents its runtime analytics and error reporting, provides opt-outs, and declares no install hook.
Static reason
One or more suspicious static signals were detected.
Trigger
CLI commands run when invoked; agent skill setup requires the explicit skill setup command.
Impact
No malicious behavior identified. The review found no install-time data collection or credential redirection.
Mechanism
The CLI contacts Toggl APIs and sends disclosed, limited analytics and error reports. The bundled skill setup passes a local package source to its installer.
AI rationale
The flagged process and credential behavior belongs to optional CLI features and does not establish an attack chain: bundled skill setup is user-triggered and uses a local source, which the dependency excludes from repository telemetry. The package documents its runtime analytics and error reporting, provides opt-outs, and declares no install hook.
Evidence
~/.agents/.skill-lock.json
Network endpoints7
focus.toggl.comaccounts.toggl.comeu.i.posthog.como43910.ingest.us.sentry.ioadd-skill.vercel.shapi.github.comskills.sh
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes the Toggl CLI and library entry points; its scripts are build and development tasks, with no install lifecycle hook.
- The README discloses product analytics and an opt-out; the code limits invocation analytics to command, action, outcome, client, session ID, and package version.
- Toggl API defaults use focus.toggl.com and accounts.toggl.com.
- Agent skill installation runs only through the explicit skill subcommand, which passes the local package root to the skills installer.
- The skills dependency excludes local sources from its repository-owner install telemetry; its telemetry guard requires a normalized repository source.
Evidence against
- Product analytics and error reporting are enabled by default, but their collection is documented and can be disabled.
- The skills dependency contains GitHub credential handling and telemetry for repository-based skill installs, but the bundled setup supplies a local package source.
Behavioral surface
ChildProcessCryptoEnvironmentVars
Source & flagged code
5 flaggedbuild/program-BWsOWISs.jsView file
6import { fileURLToPath } from "node:url";
L7: import { exec, spawn } from "node:child_process";
L8: import process$1 from "node:process";
High
Child Process
Package source references child process execution.
build/program-BWsOWISs.jsView on unpkg · L61830if (process$3.versions?.electron) parseOptions.from = "electron";
L1831: const execArgv = process$3.execArgv ?? [];
L1832: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) parseOptions.from = "eval";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
build/program-BWsOWISs.js:
import * as readline from "node:readline";
import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
import { createInterface } from "node:readline/promises";
function readline$1() {
const cleanFn = cb(readline$1());
* Returns the width of the active readline, or 80 as default value.
function readlineWidth() {
output: readline$1().output
Findings
5 High2 Medium5 Low
HighChild Processbuild/program-BWsOWISs.js
HighShellbuild/program-BWsOWISs.js
HighCredential Redirect Persistencebuild/program-BWsOWISs.js
HighCommand Output Exfiltrationbuild/program-BWsOWISs.js
HighTrigger Reachable Command Output Exfiltrationbuild/program-BWsOWISs.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @togglhq/cli@1.13.147.
See all versions of @togglhq/cli for other recorded verdicts.
- Review the evidence and your use of @togglhq/cli@1.13.147 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.