clickup-prod-checklist
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The health verification script ingests data from ClickUp's official API and status endpoints to verify the integration environment.
- Ingestion points: Fetches workspace and status data from
api.clickup.comandstatus.clickup.cominSKILL.md. - Boundary markers: Absent; the script relies on structured JSON parsing to process the responses.
- Capability inventory: Uses
Bash(curl) for network requests andpython3for specific field extraction. - Sanitization: Uses structured parsing (
json.load) to extract only relevant fields such as the number of teams and status descriptions, reducing the risk of malicious content affecting the agent's logic. - [COMMAND_EXECUTION]: The skill includes a shell script designed for production health verification.
- Executes
curlto verify authentication, check rate limit headroom, and measure API latency against ClickUp's official service. - Uses
python3 -cfor parsing JSON data from the API responses. - These commands are standard for the skill's stated purpose of verifying API integration health.
- [EXTERNAL_DOWNLOADS]: The skill fetches configuration and status information from well-known ClickUp services.
- Fetches user and workspace data from
api.clickup.com. - Retrieves platform status summaries from
status.clickup.com.
Audit Metadata