registry / @togglhq/cli / 1.13.29
@togglhq/cli@1.13.29
Toggl CLI for Toggl 2.0 API operations.
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe scanner’s command and network matches resolve to OAuth, product telemetry, and user-invoked CLI or skill operations. The package has no install hook, and the inspected credential flow does not show disclosure to an unrelated recipient.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs the CLI or invokes its authentication or skill setup commands.
Impact
The inspected behavior does not establish credential theft, command-output exfiltration, or unconsented agent configuration changes.
Mechanism
The CLI exchanges OAuth codes with its configured accounts service, initializes product telemetry, and delegates skill setup to the bundled skills tool using supplied options.
AI rationale
The scanner’s command and network matches resolve to OAuth, product telemetry, and user-invoked CLI or skill operations. The package has no install hook, and the inspected credential flow does not show disclosure to an unrelated recipient.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the CLI and program entrypoints and declares no install lifecycle hook; the root CLI is invoked by the user.
- The flagged agent integration code searches agent skill directories and forwards explicit skill, agent, global, copy, and confirmation options to the skills tool.
- Authentication defaults to Toggl’s accounts service; OAuth exchanges an authorization code there, and the staging host is selected only when the accounts URL is set to that host.
- The API token is read from the caller’s environment and selects token mode; inspected source contains no transfer of that token to an unrelated fixed recipient.
- CLI telemetry starts when the CLI runs, with Toggl product analytics and public Sentry privacy controls; this is runtime product behavior, not install-time disclosure.
- The prepared dependencies expose their expected Sentry SDK and skills CLI entrypoints; the flagged command execution is used to launch the selected CLI or skill operation.
Evidence against
Behavioral surface
ChildProcessCrypto
Source & flagged code
5 flaggedbuild/program-BuVQW29L.jsView file
6import { fileURLToPath } from "node:url";
L7: import { exec, spawn } from "node:child_process";
L8: import process$1 from "node:process";
High
Child Process
Package source references child process execution.
build/program-BuVQW29L.jsView on unpkg · L61830if (process$3.versions?.electron) parseOptions.from = "electron";
L1831: const execArgv = process$3.execArgv ?? [];
L1832: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) parseOptions.from = "eval";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
build/program-BuVQW29L.js:
import * as readline from "node:readline";
import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
import { createInterface } from "node:readline/promises";
function readline$1() {
const cleanFn = cb(readline$1());
* Returns the width of the active readline, or 80 as default value.
function readlineWidth() {
output: readline$1().output
Findings
5 High2 Medium5 Low
HighChild Processbuild/program-BuVQW29L.js
HighShellbuild/program-BuVQW29L.js
HighCredential Redirect Persistencebuild/program-BuVQW29L.js
HighCommand Output Exfiltrationbuild/program-BuVQW29L.js
HighTrigger Reachable Command Output Exfiltrationbuild/program-BuVQW29L.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @togglhq/cli@1.13.29.
See all versions of @togglhq/cli for other recorded verdicts.
- Review the evidence and your use of @togglhq/cli@1.13.29 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.