The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install a binary using npx -y @mvanhorn/printing-press-library install clickup --cli-only and go install github.com/mvanhorn/printing-press-library/.... These commands download and execute code from the npm registry and GitHub, respectively. While these resources are associated with the skill's author, they represent the installation of external code into the environment.
[DATA_EXFILTRATION]: The CLI tool documents a --deliver webhook:<url> flag which enables the agent to POST the output of any command to an arbitrary external URL via HTTP. This feature provides a direct primitive for exfiltrating sensitive data retrieved from the ClickUp API (such as task content, docs, or messages) or metadata about local files processed by the CLI.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of data from the ClickUp API (tasks, comments, docs, chat), which are attacker-controllable external sources.
Ingestion points: Data enters the agent's context through commands such as sync, task get, chat messages, and docs search defined in SKILL.md.
Boundary markers: The skill lacks explicit instructions or delimiters to isolate untrusted data from the agent's prompt, increasing the risk of the agent obeying instructions embedded within ClickUp content.
Capability inventory: The skill possesses powerful capabilities including reading local files (task attach), writing to a local SQLite database (sync), and making network requests (chat send, webhook delivery).
Sanitization: No sanitization, filtering, or validation of the external API content is mentioned before it is processed by the agent.
[COMMAND_EXECUTION]: The skill is centered around executing the clickup-pp-cli binary. This involves passing arguments and file paths (e.g., in task attach) from the agent to the shell, which could be exploited if not handled carefully.

pp-clickup