registry / @togglhq/cli / 1.13.33
@togglhq/cli@1.13.33
Toggl CLI for Toggl 2.0 API operations.
AI Security Review
scanned 14d ago · by lpm-firewall-aiSource inspection did not substantiate the scanner’s credential-redirection or command-output exfiltration findings. The reviewed network behavior is Toggl authentication and restricted, opt-out analytics; agent skill writes occur through a separately invoked installation flow.
Static reason
One or more suspicious static signals were detected.
Trigger
The CLI runs when invoked; authentication and skill installation require user actions.
Impact
No malicious effect was established.
Mechanism
Authentication uses the Toggl account API by default. Analytics sends a restricted command summary, and the separate skills CLI installs files after confirmation.
AI rationale
Source inspection did not substantiate the scanner’s credential-redirection or command-output exfiltration findings. The reviewed network behavior is Toggl authentication and restricted, opt-out analytics; agent skill writes occur through a separately invoked installation flow.
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points to a CLI entry point and lists build, lint, format, and test scripts; it declares the inspected Sentry and skills dependencies.
- The account API defaults to Toggl. Alternate URLs come from explicit options or environment settings, and the authorization code is exchanged with the selected account API.
- CLI analytics can be disabled through an environment setting. Its payload is limited to command, action, outcome, session, version, and categorized error fields; it does not include arguments or results.
- The skills dependency exposes a separate CLI. Its agent skill directories are search paths, and installation is a prompted operation that calls the skill-writing function.
- The inspected Sentry dependency manifests identify its ESM and CommonJS entry points; the flagged Fastify constants file defines an OpenTelemetry symbol.
Evidence against
- The flagged command-execution behavior is in an explicit self-update command; inspected telemetry captures command summaries rather than command output.
- The source shows no package install lifecycle hook, fixed unofficial account gateway, or automatic agent configuration write.
Source & flagged code
5 flaggedbuild/program-BeDTimTY.jsView file
6import { fileURLToPath } from "node:url";
L7: import { exec, spawn } from "node:child_process";
L8: import process$1 from "node:process";
High
Child Process
Package source references child process execution.
build/program-BeDTimTY.jsView on unpkg · L61830if (process$3.versions?.electron) parseOptions.from = "electron";
L1831: const execArgv = process$3.execArgv ?? [];
L1832: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) parseOptions.from = "eval";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
build/program-BeDTimTY.js:
import * as readline from "node:readline";
import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
import { createInterface } from "node:readline/promises";
function readline$1() {
const cleanFn = cb(readline$1());
* Returns the width of the active readline, or 80 as default value.
function readlineWidth() {
output: readline$1().output
Findings
5 High2 Medium5 Low
HighChild Processbuild/program-BeDTimTY.js
HighShellbuild/program-BeDTimTY.js
HighCredential Redirect Persistencebuild/program-BeDTimTY.js
HighCommand Output Exfiltrationbuild/program-BeDTimTY.js
HighTrigger Reachable Command Output Exfiltrationbuild/program-BeDTimTY.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @togglhq/cli@1.13.33.
See all versions of @togglhq/cli for other recorded verdicts.
- Review the evidence and your use of @togglhq/cli@1.13.33 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.