clickup
3 findings (1 critical, 2 high), mainly data exfiltration, unauthorized tool use. Most recent scan 2026-02-01.
This ClickUp integration skill presents CRITICAL and HIGH security risks primarily related to credential management and unrestricted data access. The skill requires a ClickUp API token with full access to all workspaces, tasks, documents, and time tracking data, but lacks secure credential storage, access controls, and proper security documentation. The missing allowed-tools declaration prevents enforcement of appropriate restrictions. While the skill appears to be legitimately designed for ClickUp integration (no evidence of malicious code, data exfiltration, or prompt injection), its broad permissions and lack of security guardrails make it suitable only for highly trusted environments. The code quality is professional and there are no obvious backdoors, but the security posture needs significant improvement before enterprise deployment.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Enterprise-grade ClickUp project management integration with advanced reporting, multi-workspace support, and client/project tracking. Core capabilities: (1) Multi-workspace task management with automatic workspace switching, (2) Advanced analytics & reporting (task counts, assignee breakdowns, status/priority analysis, daily standup reports) with automatic subtask inclusion and pagination, (3) Client folder organization with project tracking (📋 Client Overview, 📁 Completed Work, active project lists), (4) Full CRUD operations for spaces, folders, lists, tasks, and custom fields, (5) Time…
- Package
- 4 files, 54 KB
- SKILL.md
- 1521 words, 12+ sections
- Code
- Python (1)
SKILL.md covers: ClickUp Skill · Key Benefits · Quick Start · Setup · Basic Operations · Workspace Hierarchy · Multi-Workspace Support · Common Workflows · Workflow: Create Task in Specific Workspace · Workflow: Configure Space Statuses · Workflow: Track Time on Task · Start timer
Findings
CRITICAL Hardcoded API Token Exposure Risk Data Exfiltrationllm
The skill requires users to set CLICKUP_API_TOKEN as an environment variable, which could lead to credential exposure if the token is hardcoded in shell configuration files, logged, or accidentally committed to version control. The client reads this token directly without any validation or secure storage mechanism.
scripts/clickup_client.py
self.api_token = api_token or os.getenv("CLICKUP_API_TOKEN")
if not self.api_token:
raise ValueError("ClickUp API token required. Set CLICKUP_API_TOKEN env var.")HIGH Unrestricted API Access to Sensitive Data Data Exfiltrationllm
The skill provides full CRUD access to all ClickUp workspaces, tasks, documents, and time tracking data without any access controls or data minimization. Scripts can read, modify, or delete any data the API token has access to, including potentially sensitive client information, financial data (billing/retainer info), and confidential project details.
scripts/clickup_client.py
Full implementation of get_teams(), get_spaces(), get_tasks(), create_task(), update_task(), delete_task(), get_time_entries(), create_time_entry() with no access restrictionsHIGH Missing allowed-tools Declaration Enables Unrestricted Operations Unauthorized Tool Usellm
The skill manifest does not declare allowed-tools, yet the Python scripts perform extensive file system operations, network requests, and data manipulation. This lack of declaration prevents users and systems from understanding the skill's actual capabilities and enforcing appropriate restrictions.
SKILL.md
allowed-tools: Not specified
But scripts perform: HTTP requests (requests library), environment variable access (os.getenv), JSON parsing, file operations (implicit in script execution)What is in the package
| File | Kind | Size |
|---|---|---|
CHANGELOG.md | doc | 5.4 KB |
SKILL.md | doc | 14 KB |
references/api_reference.md | doc | 5.9 KB |
scripts/clickup_client.py | script | 29 KB |
External hosts referenced
app.clickup.com api.clickup.com clickup.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
CLICKUP_API_TOKEN
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/clickup-skill
- Raw scan result: clickup-skill-scan.json
- Badge for your README:
- Request a re-scan