clickup-automation
Warn
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires users to add a remote MCP server endpoint (https://rube.app/mcp) to their configuration. Because this endpoint is an unverified third-party service, it introduces a supply chain risk where the remote server could provide malicious tools or code that the agent then executes within its environment.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from ClickUp tasks and comments, which can be modified by external users to influence agent behavior.
- Ingestion points: Data enters the agent's context through tools like CLICKUP_GET_TASK, CLICKUP_GET_TASKS, and CLICKUP_GET_TASK_COMMENTS as outlined in the core workflows of SKILL.md.
- Boundary markers: There are no instructions for using delimiters or explicit warnings to the agent to ignore instructions embedded within the retrieved task content.
- Capability inventory: The skill exposes powerful capabilities including task creation (CLICKUP_CREATE_TASK), modification (CLICKUP_UPDATE_TASK), deletion (CLICKUP_DELETE_TASK), and commenting (CLICKUP_CREATE_TASK_COMMENT).
- Sanitization: The instructions do not define any validation or filtering mechanisms to sanitize the content of tasks or comments before they are used to determine subsequent agent actions.
Audit Metadata