Security audit

Toggl

Security checks for vulnerabilities and agentic risk

Overview

This Toggl skill does what it says, but should be reviewed because it installs an unpinned global third-party CLI, stores an API token locally, and can delete time records without documented confirmation.

Install only if you are comfortable with a third-party global npm CLI accessing your Toggl account. Prefer pinning and reviewing a specific package version, keep the token file restricted, rotate the token if exposed, and require explicit confirmation before editing or deleting time entries.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:13
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation
``` 2. Verify the selected release's provenance, publisher, repository, dependency tree, and published integrity metadata before recommending it. 3. Prefer a project-local installation with a committed lockfile over global installation where operationally feasible: ```bash npm install --save-exact @beauraines/toggl-cli@ ``` 4. Invoke the locked local binary through an npm script rather than relying on a mutable global executable. 5. Review package lifecycle scripts and dependencies before installation. Where compatible with the verified package, consider disabling lifecycle scripts during installation and explicitly running only necessary setup steps. 6. Execute the CLI under a least-privileged user account and ensure `~/.toggl-cli.json` remains restricted to that account with mode `600`. 7. Limit the Toggl token's effective access where supported, avoid exposing it to unrelated processes, and rotate it immediately if dependency compromise is suspected. 8. Establish a controlled update process in which new versions are reviewed and tested before changing the pinned version. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger list includes broad, everyday phrases such as "timer," "track time," and "what am I working on," which can cause the skill to activate in situations where the user did not intend to invoke Toggl actions. In a skill that can start, stop, edit, or delete time entries, accidental activation increases the risk of unintended state changes and confusing or destructive operations.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: The skill instructs users to persist a long-lived API token in ~/.toggl-cli.json, which creates a durable local secret that could be exposed through backup leakage, misconfigured permissions, endpoint compromise, or accidental disclosure. Although the file permission guidance helps, persistent plaintext credential storage still increases the blast radius compared with more ephemeral authentication methods.
Content: Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.
npm install -g @beauraines/toggl-cli

text
Configure authentication (create `~/.toggl-cli.json`): ```json { "api_token": "YOUR_TOGGL_API_TOKEN",

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.
md
Get your API token from: https://track.toggl.com/profile Get your workspace ID from your Toggl URL: `https://track.toggl.com/{workspace_id}/...` Set permissions: `chmod 600 ~/.toggl-cli.json` ## Commands

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill documents a destructive command (toggl rm <id>) without any warning, confirmation, or guidance about irreversible impact. In the context of a time-tracking skill, this makes accidental or automated deletion of time records more likely, which can affect billing, reporting, and audit accuracy.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.