The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill documentation instructs users to install a CLI tool from a public registry.
- Package: @discountry/clickup-cli is installed globally via npm install and used by the agent to interact with the ClickUp API.
- Reference: The skill also mentions adding itself via a GitHub URL (https://github.com/discountry/clickup-cli). These are documented vendor resources from the skill's author.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external ClickUp tasks and documents, which could potentially harbor hidden instructions designed to influence the agent's behavior.
- Ingestion points: SKILL.md contains commands to read task data, comments, and document content (clickup get, clickup comments, clickup doc, clickup page).
- Boundary markers: Absent. There are no explicit instructions or delimiters defined to separate user-provided ClickUp content from the agent's instructions.
- Capability inventory: SKILL.md identifies several write capabilities, including task creation, comment addition, and document editing (clickup create, clickup comment, clickup edit-page).
- Sanitization: Absent. The skill does not specify any sanitization or validation of the retrieved content before it enters the agent's context.

clickup