clickup-performance-tuning
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the ClickUp API which could potentially contain malicious instructions intended to influence the agent.
- Ingestion points: ClickUp API response payloads, including task details and comments, as described in the instructions and documentation references.
- Boundary markers: The instructions require the agent to confirm target files, Workspace boundaries, and requested modes before performing modifications.
- Capability inventory: The skill utilizes
WriteandEdittools to modify repository adapters, tests, and configuration files based on processed data. - Sanitization: The instructions explicitly mandate the redaction of sensitive identifiers, task text, and credentials from output evidence, and recommend using authorized synthetic or non-sensitive data for benchmarks.
- [EXTERNAL_DOWNLOADS]: The skill fetches reference material and documentation from official ClickUp developer resources.
- Sources: Verified content is retrieved from official domains including developer.clickup.com, status.clickup.com, and the official ClickUp GitHub repository.
Audit Metadata