clickup-core-workflow-b
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from the ClickUp API, creating an attack surface for indirect prompt injection if external task or workspace data contains malicious instructions.
- Ingestion points: Data enters the agent's context through ClickUp API responses (e.g., space, folder, and list metadata) via the
clickupRequestfunctions documented inSKILL.md. - Boundary markers: The skill includes explicit instructions to "Return a redacted scaffold receipt" and "Do not log full task data, private views, user profiles, or tokens," which helps isolate sensitive data from the agent's output.
- Capability inventory: The skill is configured to use
Bash(curl:*)for API calls andWrite/Editfor project file management. - Sanitization: The instructions require the agent to validate parent IDs and permissions before acting, and to redact sensitive information from all output receipts.
- [SAFE]: The skill documentation and provided code snippets follow standard development practices for interacting with the ClickUp v2 API. All external links point to official ClickUp developer documentation, and the instructions emphasize least privilege and human-in-the-loop verification (pilot testing). No obfuscation, hardcoded credentials, or unauthorized command execution patterns were found.
Audit Metadata