clickup
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
npx @useclawlink/clito download and run the vendor's command-line interface from the NPM registry. - [COMMAND_EXECUTION]: The skill performs all actions, such as fetching and updating ClickUp data, by executing shell commands via the ClawLink CLI tool.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface that could potentially process untrusted content from ClickUp.
- Ingestion points: Reads task descriptions, comments, and list data from external ClickUp workspaces via CLI commands like
clickup_get_taskandclickup_get_task_comments(SKILL.md). - Boundary markers: None identified in the provided instructions.
- Capability inventory: The skill has the ability to execute ClickUp actions (create, update, delete) and run shell commands via the CLI (SKILL.md).
- Sanitization: The instructions do not describe explicit sanitization or filtering of the content retrieved from ClickUp before it is processed by the agent.
Audit Metadata