clickup
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: Sensitive credentials such as the ClickUp API token and Slack webhook URLs are handled via environment variables (e.g.,
CLICKUP_API_TOKEN,SLACK_WEBHOOK_URL), preventing hardcoded secrets in the code. - [SAFE]: The skill implements signature validation for incoming webhooks using HMAC-SHA256 with a secret key, which is a critical security measure to prevent unauthorized or spoofed requests.
- [SAFE]: All external communications are restricted to the official ClickUp API domain (
api.clickup.com) and user-provided notification endpoints. - [SAFE]: Code examples demonstrate standard API usage and follow industry-standard practices for rate limiting, pagination, and authorization.
Audit Metadata