The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill documentation specifies that user credentials for the service are stored in a persistent local file at ~/.clawlink/credentials.json, which is a sensitive file path that could be targeted for data exposure.
[EXTERNAL_DOWNLOADS]: The skill relies on npx to download and execute the @useclawlink/cli package from the NPM registry during setup and usage, representing the execution of external code not bundled with the skill.
[COMMAND_EXECUTION]: The skill instructions direct the agent to perform operations by executing shell commands via the @useclawlink/cli tool, providing a path for potential command injection if user inputs are not properly handled by the agent.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from an external platform (ClickUp) which could contain adversarial instructions.
Ingestion points: External data is brought into the agent context through actions like clickup_get_task, clickup_get_tasks, and clickup_get_task_comments as described in SKILL.md.
Boundary markers: The instructions include a procedural note to "confirm with the user before any write," but there are no technical boundary markers or specific instructions for the agent to ignore instructions embedded within the retrieved ClickUp data.
Capability inventory: The skill possesses shell command execution capabilities via npx @useclawlink/cli and network access through the same tool.
Sanitization: The skill documentation does not mention any sanitization, filtering, or validation of the data retrieved from ClickUp before it is presented to the agent's context.

clickup