ClawHub
Back to skill

Security audit

Pipeworx clickup

Security checks for vulnerabilities and agentic risk

Overview

This ClickUp skill is purpose-aligned, but it routes ClickUp access through an unexplained third-party MCP gateway that may handle workspace data and user-provided credentials.

Before installing, verify the Pipeworx gateway operator and privacy/security posture. Use a dedicated ClickUp API token with the least workspace access possible, avoid highly sensitive workspaces, and be prepared to revoke the token if the gateway behaves unexpectedly.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:25
Finding

Unverified Third-Party MCP Gateway Handles ClickUp Integration Traffic

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:25-33
Vulnerability Type: Unverified external service dependency
Risk Level: Medium

json
{
  "mcpServers": {
    "clickup": {
      "url": "https://gateway.pipeworx.io/clickup/mcp"
    }
  }
}

Technical Analysis

The skill describes a ClickUp integration using a user-provided API key but configures an externally hosted Pipeworx MCP gateway rather than an official ClickUp endpoint or an auditable local MCP implementation. This makes the third-party gateway part of the trusted execution and data path for the declared ClickUp operations.

The project provides no gateway source code, integrity verification, provenance information, privacy disclosure, or documentation explaining how authentication credentials and ClickUp data are handled. Consequently, users cannot verify from the audited package whether the service securely processes, stores, or forwards credentials and workspace information.

This is a supply-chain trust risk rather than proof that the gateway is malicious. The audited file contains no executable implementation demonstrating credential theft, arbitrary code execution, persistence, or other malicious behavior.

Attack Path

  1. A user installs or enables the MCP configuration supplied in SKILL.md.
  2. The agent connects to https://gateway.pipeworx.io/clickup/mcp.
  3. The user authorizes the integration or supplies the ClickUp credentials required by the service.
  4. Requests for task, list, folder, and space operations are mediated by the third-party gateway.
  5. If the gateway is malicious, compromised, or improperly secured, it could inspect or retain data passing through it and misuse any credentials made available to it.
  6. An attacker could then perform ClickUp API operations permitted by the exposed token until the token expires or is revoked.

Impact Assessment

The maximum impact depends on the scopes and works ...[truncated 594 chars]

Remediation
View remediation

Remediation Suggestions

  • Prefer an official ClickUp-hosted integration or an auditable local MCP server that communicates directly with https://api.clickup.com.
  • If the Pipeworx gateway must be used, document its ownership, source-code provenance, deployment controls, credential flow, data retention policy, and privacy implications.
  • Ensure API credentials are entered through a protected secret mechanism and are never embedded in skill files, command arguments, logs, or plaintext configuration.
  • Use a dedicated ClickUp token with the minimum workspace access and permissions necessary for the declared operations.
  • Avoid transmitting reusable credentials to an intermediary where possible. Prefer short-lived, revocable authorization tokens with explicit scopes.
  • Establish a credential-rotation and revocation procedure for gateway compromise or unexpected behavior.
  • Pin and verify any deployable gateway implementation or client component using reviewed source revisions and integrity checks.
  • Monitor ClickUp audit activity and gateway access for unexpected reads, task creation, or access from unfamiliar systems.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.