Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add MSApps-Mobile/claude-plugins --skill togglgit clone --depth 1 https://github.com/MSApps-Mobile/claude-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/msapps-mobile/claude-plugins/toggl)<a href="https://agentmods.dev/skills/msapps-mobile/claude-plugins/toggl"><img src="https://agentmods.dev/badge/skills/msapps-mobile/claude-plugins/toggl/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/msapps-mobile/claude-plugins/toggl"><img src="https://agentmods.dev/badge/skills/msapps-mobile/claude-plugins/toggl.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00100 | $0.02068 |
| Opus 5.5 | $0.00040 | $0.00827 |
| Sonnet 5.5 | $0.00020 | $0.00414 |
| Haiku 4.5 | $0.00010 | $0.00207 |
Grade A, and why
toggl scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
RESPONSE=$(curl -s -X POST \ How it starts
The opening of the file, as written. The whole thing — 279 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Toggl Time Tracker
Track time and pull reports via the Toggl Track API.
Environment note: This skill works in both Claude Code and Cowork. The only difference is how the config file is read in Step 1 — Claude Code reads it directly, Cowork uses osascript.
Step 1: Read the config
The config lives on the Mac at ~/.toggl-config.json.
In Claude Code (direct file system access):
CONFIG=$(cat ~/.toggl-config.json 2>/dev/null || echo "NOT_CONFIGURED")
In Cowork (VM — needs osascript to reach the Mac home):
CONFIG=$(osascript -e 'do shell script "cat ~/.toggl-config.json 2>/dev/null || echo NOT_CONFIGURED"')
Then parse it safely in Python — never log or print the raw config or API token:
python3 -c "
import json, sys, base64
raw = '''$CONFIG'''
if raw.strip() == 'NOT_CONFIGURED':
print('STATUS:NOT_CONFIGURED')
sys.exit(0)
try:
cfg = json.loads(raw)
token = cfg['apiToken']
# Build Basic Auth header: token:api_token base64-encoded
auth = base64.b64encode(f'{token}:api_token'.encode()).decode()
print('STATUS:OK')
print(f'AUTH:Basic {auth}')
print(f'WORKSPACE:{cfg.get(\"workspaceId\", \"\")}')
except Exception as e:
print(f'STATUS:PARSE_ERROR:{e}')
"
- If
STATUS:NOT_CONFIGURED→ tell the user:"Toggl isn't set up yet. Create
~/.toggl-config.jsonwith your API token:{ "apiToken": "your-toggl-api-token", "workspaceId": 1234567 }Find your API token at https://track.toggl.com/profile (scroll to 'API Token'). Find your workspace ID in the URL when logged into Toggl:
https://track.toggl.com/{workspaceId}/timer." Stop here. - If
STATUS:PARSE_ERROR→ tell the user the config file is malformed. - If
STATUS:OK→ extract AUTH and WORKSPACE from output. Continue.
IMPORTANT: The API token belongs to the user. Never print it, log it, or include it in any output shown to the user.
API Base
All requests go to:
https://api.track.toggl.com/api/v9
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 279 lines · 100 tokens per session scan A 5302c383d1fb
toggl is a skill published in the GitHub repository MSApps-Mobile/claude-plugins (9 stars, last pushed today), licensed MIT. It adds 100 tokens to every session and 2,068 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-13.
Other skills, from other repositories
houseclean
Cross-drive storage audit and cleanup. Surveys all drives, finds orphaned git worktrees, large AI tool caches (.ollama, .gemini, .cursor, npm, pip), and buildable artifacts (nodemodules, .venv). Produces a prioritized action plan with specific migration commands. Use when disk space is low or worktrees need cleanup…
schedule
Manages recurring and one-off scheduled tasks. Session-scoped scheduling via CronCreate/CronDelete/CronList. Documents the cloud path for tasks that need to survive machine sleep or network drops.
career-portfolio
A portfolio-building skill for Korean job seekers that organizes projects and explains their work for development, design, marketing, and planning roles.
hr-operations
A skill for designing remote-work and team-operation policies. It covers flexible work, asynchronous communication, collaboration tools, productivity tracking, and employee experience.
collab-conflict
A guide for handling difficult workplace colleagues and recurring communication conflicts.
collab-feedback-loop
A guide for giving and receiving workplace feedback about specific actions and their effects.