Toggl Automation
Warn
Audited by Gen Agent Trust Hub on Feb 18, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS] (MEDIUM): The skill requires users to add the
rubeMCP server (https://rube.app/mcp), which is not a recognized trusted source. This introduces a third-party dependency into the agent's environment, where all Toggl-related data and tool calls are proxied through an unverified external service.\n- [Indirect Prompt Injection] (LOW): The skill ingests untrusted data from the Toggl API (e.g., project names, tags, and descriptions) and incorporates it into the agent's context.\n - Ingestion points:
SKILL.mdspecifies tools likeTOGGL_GET_PROJECTS,TOGGL_GET_TAGS, andTOGGL_GET_LIST_CLIENTSthat retrieve external data.\n - Boundary markers: None present. There are no instructions to the agent to treat retrieved data as untrusted or to ignore embedded commands.\n
- Capability inventory: The skill includes state-changing operations such as
TOGGL_CREATE_TIME_ENTRYandTOGGL_CREATE_PROJECT.\n - Sanitization: None present. Data from external API calls is passed directly to the agent without filtering or escaping.
Audit Metadata