ClawHub

Clickup Pro

v1.0.0

AI-powered ClickUp project management — tasks, spaces, folders, time tracking, comments, custom fields. AI task prioritization by urgency and importance, dai...

⭐ 0· 327·0 current·0 all-time
by@aiwithabidi
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (ClickUp task management + optional AI features) matches the code and SKILL.md. The only required credential is CLICKUP_API_KEY (ClickUp token) and OPENROUTER_API_KEY is optional and only used by AI features — both are proportionate to the stated functionality.
ℹ
Instruction Scope
Runtime instructions and the script only call the ClickUp API (api.clickup.com) and, for LLM features, openrouter.ai. The AI features send task metadata (names, statuses, assignees, due dates) to the LLM provider — this is expected for prioritization/standups but is a data-exposure consideration the user should be aware of.
✓
Install Mechanism
No install spec or external binary downloads; this is an instruction-only skill plus an included Python script. Nothing is downloaded from arbitrary URLs and the bundle runs using standard Python libraries.
ℹ
Credentials
Only CLICKUP_API_KEY is required (primary) and OPENROUTER_API_KEY is optional for AI features. That is reasonable, but providing the OpenRouter key will send task content to a third-party LLM endpoint. Users should limit token scopes and avoid supplying high-privilege tokens if unnecessary.
✓
Persistence & Privilege
Skill does not request always:true or elevated persistence, and does not modify other skills or system-wide configs. Default autonomous invocation is allowed (platform default) but is not combined here with other red flags.
Assessment
This skill appears to do what it says: interact with ClickUp and optionally call OpenRouter for AI summaries/prioritization. Before installing, consider: 1) Use a ClickUp API token with minimal scopes needed (avoid full admin tokens if possible). 2) If you enable AI features, know that task names, statuses, assignees, and due dates are sent to openrouter.ai — treat that as sensitive data leakage and only provide OPENROUTER_API_KEY if you trust the provider and accept that data flow. 3) Review the included Python script yourself (it’s bundled) and test with a low-privilege token first. 4) Note there are minor implementation bugs (e.g., some API calls may not pass expected payloads), but these look like quality issues rather than malicious behavior.

Like a lobster shell, security has layers — review code before you run it.

latestvk978vtsb0nsrqwd2nc5tkah1s981x0sr

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

✅ Clawdis
EnvCLICKUP_API_KEY
Primary envCLICKUP_API_KEY

Comments