clickup

SUSPICIOUS. The core purpose is coherent for a ClickUp integration, and data appears intended to flow to ClickUp rather than an unrelated intermediary. However, the skill relies on a global external CLI with some provenance ambiguity (`clickup` vs documented `clickup-cli`/`cup`) and likely binary-download install behavior, so install trust is only partially verifiable. Main risk is supply-chain/credential handling through the CLI, not confirmed malware.