The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from external sources, specifically ClickUp task descriptions, comments, and attachments. Malicious instructions embedded in these fields could attempt to influence the agent's execution flow.
Ingestion points: Data enters the context through clickupfy_task_get (body, checklists) and clickupfy_comments_list (historical context and new instructions).
Boundary markers: The skill lacks explicit structural delimiters for untrusted content, though it includes a high-level instruction to treat ClickUp content as an untrusted input.
Capability inventory: The agent has access to CLI tools (clickupfy), local build scripts (npm run ebook), and file system write access for documentation updates.
Sanitization: There are no explicit instructions for escaping or sanitizing data retrieved from ClickUp before it is used in logic or documentation generation.
[COMMAND_EXECUTION]: The skill instructions mandate the use of shell commands for task management and documentation verification. There is a potential risk of command injection if identifiers (IDs) or parameters sourced from untrusted ClickUp tasks are passed directly to the shell without sufficient validation by the underlying tools.
Evidence: Usage of clickupfy --account <perfil> task get <task-id> --json and npm run ebook.
[DATA_EXPOSURE]: The skill manages potentially sensitive project metadata and documentation. Although it includes a specific prohibition against publishing credentials, personal data, or signed URLs, the automated nature of its reporting (posting comments back to ClickUp) could lead to accidental exposure of sensitive information found within the repository or environment if prompted by malicious task instructions.

clickup-issue-implement