Basecamp CLI

What to check before installing: - Verify the package publisher and source: package.json points to a GitHub repo (emredoganer/basecamp-cli). Visit that repo and confirm it matches the code here and is maintained by a trusted author. The skill metadata (registry) failing to declare required env vars is suspicious—don't trust the registry entry alone. - Confirm credential handling: the README/SKILL.md ask you to set BASECAMP_CLIENT_SECRET in your shell. Inspect src/lib/config.ts and src/lib/auth.ts in the repo to confirm the secret is not written to disk and to see how access tokens are persisted (the code likely uses the 'conf' package). Prefer using a short-lived OAuth flow or an access token with limited scope if possible. - If you will install globally (npm -g), be aware the CLI will run on your machine and can access anything your user account can. Only install if you trust the package and author. - If you are especially cautious: run the CLI in a disposable environment (container or dedicated VM), or audit the compiled/dist files before granting credentials. - If you maintain automated tooling that checks skill metadata, update the registry entry or ask the publisher to declare required env vars (BASECAMP_CLIENT_ID, BASECAMP_CLIENT_SECRET, optional BASECAMP_ACCESS_TOKEN) so permission prompts are accurate. Confidence note: I reviewed the SKILL.md, README, package.json and many command files; some lib files were truncated in the provided bundle so I could not fully verify exact token storage logic—inspect src/lib/config.ts and src/lib/auth.ts to raise confidence to high.