7pace-time-tracker — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited 7pace-time-tracker (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill targets [7pace Timetracker](https://www.7pace.com/) for Azure DevOps. All time entries (worklogs) are created in 7pace via its REST API at https://<org>.timehub.7pace.com.Creates / updates / deletes worklogs in 7pace. Prefer the API script (scripts/timetracker.py) — it calls the 7pace REST API directly and is far cheaper than driving the UI. Fall back to the browser UI only if no API token is available.
It supports two modes:
--date <date> --hours <H>.--from <start> --to <end> --hours "<pattern>" (weekends are skipped automatically).SCRIPT = this skill's scripts/timetracker.py. Config lives at ~/.7pace/config.json (the default — --config <path> only needed to override). Always pass --yes --json for automation.
python SCRIPT --auth prompts (input hidden) for the 7pace Bearer API token (7pace → Settings → Reporting & API → Create New Token) and an optional Azure DevOps PAT (only for --search, scope "Work Items (Read)"), and writes ~/.7pace/config.json (chmod 600, gitignored). The two tokens are different systems — the ADO PAT does not work for 7pace and vice-versa. Skip if config already has valid tokens.
| Input | How to pass | Notes |
|---|---|---|
| One date | --date 2026-04-09 | Single-day mode. Accepts YYYY-MM-DD, DD-MM-YYYY, today, or yesterday. Convert other relative dates ("last Friday") to an absolute YYYY-MM-DD yourself. |
| Date range | --from 2026-04-01 --to 2026-06-08 | Batch mode. Same date formats; --to today = up to today. |
| Hours (single) | --hours 4 or --hours 7:30 | Decimal or HH:MM; comma or dot both work (7,5 = 7.5 = 7:30). |
| Hours (range) | --hours "7.5 mon-thu and 7.0 fri" | Per-weekday pattern. Weekday tokens: mon tue wed thu fri sat sun (or full names). Only the named days are created, so Sat/Sun are skipped. all = all weekdays. |
| Comment | --comment "Work" | Mandatory — 7pace rejects empty comments. |
| Work item | --work-item 12345 | Numeric ID. If the user gives a name instead, resolve it with --search first (see Examples). |
Many organizations require public holidays that fall on a weekday to be booked on a dedicated non-working-time work item (with a fixed comment such as "Public holiday", same hours as a normal day) — NOT the normal work item. If the user's organization has such a policy: ask for (or look up in your notes) the holiday work item ID and comment, apply the local public-holiday calendar, and if a holiday already has time logged, flag it instead of duplicating.
Replace dates/IDs/hours with the user's actual request. --json returns machine-readable output you can parse and report back.1. Single day, known work item ("register 4 hours on #12345 on 9 April 2026"):
python SCRIPT --date 2026-04-09 --hours 4 --work-item 12345 --comment "Work" --yes --json2. Single day = today ("log 7.5 hours today on #12345"):
python SCRIPT --date today --hours 7.5 --work-item 12345 --comment "Work" --yes --json3. Register by work-item NAME ("log 7:30 today on Website Redesign") — search → pick → create:
python SCRIPT --search "Website Redesign" --json # returns matches with id/title/project/state
# 1 match → use it. Multiple → ask the user which id (show title — project — state). 0 → tell them.
python SCRIPT --date today --hours 7:30 --work-item <id> --comment "Work" --yes --json4. Date range with a weekday pattern ("7:30 Mon–Thu and 7:00 Fri from 1 April to today"):
python SCRIPT --from 2026-04-01 --to today --hours "7.5 mon-thu and 7.0 fri" --work-item 12345 --comment "Work" --yes --jsonWeekends are skipped automatically; days that already have time are skipped by default (--no-skip-existing to override).
5. A holiday weekday (book non-working time, if the org has such a policy):
python SCRIPT --date 2026-05-14 --hours 7.5 --work-item <holiday-item-id> --comment "Public holiday" --yes --json6. List, update, delete (find an entry's id, change it, or remove it):
python SCRIPT --date 2026-04-09 --list --json # -> worklogs with ids
python SCRIPT --update <id> --hours 8 --work-item 12345 --comment "Work" --yes --json
python SCRIPT --delete <id> --yes --json7. Dry-run / health check (verify auth + connection, creates nothing):
python SCRIPT --date today --hours 0 --dry-run --json # expect status: dry_runstatus: dry_run.--date <holiday> --list to get the id, then --update <id> --work-item <holiday-item-id> --comment "Public holiday" --hours <h> --yes. (--update sets the work item from --work-item; always pass it so you don't reset it.)--from <start> --to <end> --list --json and confirm every weekday in range has an entry — normal work item on regular days, the holiday work item on holiday weekdays. The only acceptable blanks are weekends and pre-existing days you intentionally left. Any other blank weekday is a gap → fix and re-list. Don't declare done until clean.status: error/partial.For a single day you don't need the full workflow — just confirm the request and run Example 1/2/3, then report.
--search "<text>" matches work-item titles org-wide (across all ADO projects) by default; add --project "MyProject" to narrow. Returns matches (id, title, type, state, project). Exactly 1 → use it; multiple → ask the user (show id — title — project — state, so they avoid Obsolete/closed items); 0 → tell them; ~50 (the cap) → ask them to refine.
If the script returns status: error with 401/auth problems, the token is missing/expired → tell the user to regenerate the 7pace token (Settings → Reporting & API; it is NOT the Azure DevOps PAT) or run --auth. Only then consider Method 2.
Only if the API token cannot be used. Drive the 7pace Timesheet weekly grid via the claude-in-chrome MCP. Full click recipe, coordinates and gotchas (masked Length field, double-click-Comment trick, limited-mode data lag) are in REFERENCE.md.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.