otta-cli
PassAudited by ClawScan on May 10, 2026.
Overview
This instruction-only skill is coherent for Otta time-tracking CLI use, but users should review credential handling, the external CLI binary, and any commands that change or delete worktime records.
Before installing, make sure you trust the `otta` binary you have installed, provide credentials through safe secret handling, and manually review any command that adds, updates, or deletes worktime records.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If the agent runs a command with the wrong date, ID, project, or worktype, it could change or remove time-tracking records.
The skill documents commands that can create, modify, or delete Otta worktime records. This is aligned with the stated purpose, but these are account/business-data mutations.
manage worktimes (list/add/update/delete) ... `otta worktimes add` ... `otta worktimes update` ... `otta worktimes delete`
Review and confirm record-changing commands, especially update/delete operations, and prefer listing the target records first.
The agent may act with the permissions of the supplied Otta account.
The skill expects Otta account credentials and tokens. That is normal for this integration, and it also advises not to print raw credentials or tokens.
`otta auth login --username "$OTTA_CLI_USERNAME" --password "$OTTA_CLI_PASSWORD" --format json` ... `OTTA_CLI_ACCESS_TOKEN` ... `OTTA_CLI_REFRESH_TOKEN`
Use proper secret handling, prefer `--password-stdin` where possible, and avoid sharing credentials in prompts or logs.
Security depends on the external `otta` binary installed in the user’s environment.
The skill relies on an external CLI binary, but the supplied package contains no install spec or code for that binary to review.
Use the `otta` binary directly. ... Main repository: https://github.com/mekedron/otta-cli
Install `otta-cli` only from a trusted source and verify the installed binary before allowing account operations.
Stale or incorrect cached user/worktimegroup metadata could cause commands to apply to an unintended context.
The CLI uses cached metadata as fallbacks for later operations. This is purpose-aligned, but cached local state can affect future commands.
`status` updates cached user metadata (for `user` and `worktimegroup` fallbacks used by worktimes/holidays/calendar commands).
Check `otta config path`, `otta config cache-path`, and `otta status --format json`, especially on shared machines or when switching accounts.