clickup-prod-checklist

Pass

Audited by Gen Agent Trust Hub on Sep 10, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The health verification script ingests data from ClickUp's official API and status endpoints to verify the integration environment.
  • Ingestion points: Fetches workspace and status data from api.clickup.com and status.clickup.com in SKILL.md.
  • Boundary markers: Absent; the script relies on structured JSON parsing to process the responses.
  • Capability inventory: Uses Bash (curl) for network requests and python3 for specific field extraction.
  • Sanitization: Uses structured parsing (json.load) to extract only relevant fields such as the number of teams and status descriptions, reducing the risk of malicious content affecting the agent's logic.
  • [COMMAND_EXECUTION]: The skill includes a shell script designed for production health verification.
  • Executes curl to verify authentication, check rate limit headroom, and measure API latency against ClickUp's official service.
  • Uses python3 -c for parsing JSON data from the API responses.
  • These commands are standard for the skill's stated purpose of verifying API integration health.
  • [EXTERNAL_DOWNLOADS]: The skill fetches configuration and status information from well-known ClickUp services.
  • Fetches user and workspace data from api.clickup.com.
  • Retrieves platform status summaries from status.clickup.com.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 10, 2026, 08:28 PM