{
  "skill_name": "clickup",
  "skill_path": "/workspace/skills/clawhub-clickup-skill",
  "skill_directory": "/workspace/skills/clawhub-clickup-skill",
  "is_safe": false,
  "max_severity": "CRITICAL",
  "findings_count": 3,
  "findings": [
    {
      "id": "llm_finding_clickup_0",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "CRITICAL",
      "title": "Hardcoded API Token Exposure Risk",
      "description": "The skill requires users to set CLICKUP_API_TOKEN as an environment variable, which could lead to credential exposure if the token is hardcoded in shell configuration files, logged, or accidentally committed to version control. The client reads this token directly without any validation or secure storage mechanism.",
      "file_path": "scripts/clickup_client.py",
      "line_number": null,
      "snippet": "self.api_token = api_token or os.getenv(\"CLICKUP_API_TOKEN\")\nif not self.api_token:\n    raise ValueError(\"ClickUp API token required. Set CLICKUP_API_TOKEN env var.\")",
      "remediation": "Implement secure credential storage using system keychains (e.g., keyring library), provide warnings about token security in documentation, validate token format before use, and consider implementing token rotation mechanisms.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This ClickUp integration skill presents CRITICAL and HIGH security risks primarily related to credential management and unrestricted data access. The skill requires a ClickUp API token with full access to all workspaces, tasks, documents, and time tracking data, but lacks secure credential storage, access controls, and proper security documentation. The missing allowed-tools declaration prevents enforcement of appropriate restrictions. While the skill appears to be legitimately designed for ClickUp integration (no evidence of malicious code, data exfiltration, or prompt injection), its broad permissions and lack of security guardrails make it suitable only for highly trusted environments. The code quality is professional and there are no obvious backdoors, but the security posture needs significant improvement before enterprise deployment.",
        "primary_threats": [
          "Data Exfiltration Risk (credential exposure)",
          "Unrestricted API Access",
          "Missing Access Controls",
          "Resource Exhaustion Potential",
          "Insufficient Input Validation"
        ],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "Environment variable usage is standard practice for API tokens, but lack of security documentation increases risk of misuse. This is a real concern for enterprise deployments.",
        "meta_exploitability": "Medium - Requires user error (committing token to git, logging env vars) rather than a direct vulnerability in the skill code",
        "meta_impact": "High - Exposed token grants full access to all ClickUp workspaces, tasks, and documents"
      }
    },
    {
      "id": "llm_finding_clickup_1",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "HIGH",
      "title": "Unrestricted API Access to Sensitive Data",
      "description": "The skill provides full CRUD access to all ClickUp workspaces, tasks, documents, and time tracking data without any access controls or data minimization. Scripts can read, modify, or delete any data the API token has access to, including potentially sensitive client information, financial data (billing/retainer info), and confidential project details.",
      "file_path": "scripts/clickup_client.py",
      "line_number": null,
      "snippet": "Full implementation of get_teams(), get_spaces(), get_tasks(), create_task(), update_task(), delete_task(), get_time_entries(), create_time_entry() with no access restrictions",
      "remediation": "Implement principle of least privilege by: (1) documenting minimum required API scopes, (2) adding optional access controls to limit operations to specific workspaces/spaces, (3) requiring explicit user confirmation for destructive operations (delete, bulk updates), (4) implementing audit logging for sensitive operations.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This ClickUp integration skill presents CRITICAL and HIGH security risks primarily related to credential management and unrestricted data access. The skill requires a ClickUp API token with full access to all workspaces, tasks, documents, and time tracking data, but lacks secure credential storage, access controls, and proper security documentation. The missing allowed-tools declaration prevents enforcement of appropriate restrictions. While the skill appears to be legitimately designed for ClickUp integration (no evidence of malicious code, data exfiltration, or prompt injection), its broad permissions and lack of security guardrails make it suitable only for highly trusted environments. The code quality is professional and there are no obvious backdoors, but the security posture needs significant improvement before enterprise deployment.",
        "primary_threats": [
          "Data Exfiltration Risk (credential exposure)",
          "Unrestricted API Access",
          "Missing Access Controls",
          "Resource Exhaustion Potential",
          "Insufficient Input Validation"
        ],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_validated": true,
        "meta_confidence": "MEDIUM",
        "meta_confidence_reason": "This is a limitation of ClickUp's API design, not a flaw in the skill. The skill accurately implements the API. However, better documentation would help users understand the security implications.",
        "meta_exploitability": "Low - Requires the user to grant a token with broad permissions, which is how ClickUp's API works by design",
        "meta_impact": "Medium - Broad access is expected for a project management integration, but users should be aware of the scope"
      }
    },
    {
      "id": "llm_finding_clickup_2",
      "rule_id": "LLM_UNAUTHORIZED_TOOL_USE",
      "category": "unauthorized_tool_use",
      "severity": "HIGH",
      "title": "Missing allowed-tools Declaration Enables Unrestricted Operations",
      "description": "The skill manifest does not declare allowed-tools, yet the Python scripts perform extensive file system operations, network requests, and data manipulation. This lack of declaration prevents users and systems from understanding the skill's actual capabilities and enforcing appropriate restrictions.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "allowed-tools: Not specified\n\nBut scripts perform: HTTP requests (requests library), environment variable access (os.getenv), JSON parsing, file operations (implicit in script execution)",
      "remediation": "Add explicit allowed-tools declaration to manifest: allowed-tools: [Python, Read]. Document that the skill requires network access to ClickUp API. Consider splitting into read-only and read-write variants with different tool permissions.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This ClickUp integration skill presents CRITICAL and HIGH security risks primarily related to credential management and unrestricted data access. The skill requires a ClickUp API token with full access to all workspaces, tasks, documents, and time tracking data, but lacks secure credential storage, access controls, and proper security documentation. The missing allowed-tools declaration prevents enforcement of appropriate restrictions. While the skill appears to be legitimately designed for ClickUp integration (no evidence of malicious code, data exfiltration, or prompt injection), its broad permissions and lack of security guardrails make it suitable only for highly trusted environments. The code quality is professional and there are no obvious backdoors, but the security posture needs significant improvement before enterprise deployment.",
        "primary_threats": [
          "Data Exfiltration Risk (credential exposure)",
          "Unrestricted API Access",
          "Missing Access Controls",
          "Resource Exhaustion Potential",
          "Insufficient Input Validation"
        ],
        "aitech": "AITech-12.1",
        "aitech_name": "Tool Exploitation",
        "aisubtech": "AISubtech-12.1.2",
        "aisubtech_name": "Tool Poisoning",
        "scanner_category": "SUSPICIOUS CODE EXECUTION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The skill clearly uses Python scripts and environment variables. Missing metadata is a policy violation, not a security threat.",
        "meta_exploitability": "N/A - This is a metadata/documentation issue, not an exploitable vulnerability",
        "meta_impact": "Low - Missing metadata reduces transparency but doesn't create a security vulnerability"
      }
    }
  ],
  "scan_duration_seconds": 42.528109312057495,
  "duration_ms": 42528,
  "analyzers_used": [
    "static_analyzer",
    "llm_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-01T20:17:12.363820"
}