Security audit

ClickUp Skill

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate ClickUp integration that can read and change live ClickUp workspace data when given an API token.

Install only if you are comfortable giving this skill a ClickUp API token with access to your workspaces. Use the least-privileged token or account available, keep the token out of shared logs and shell history, verify workspace/list/task/document IDs before writes, and manually review delete, dependency, link, timer, and bulk-edit operations before running them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill requires a ClickUp API token and makes network calls, but it does not declare corresponding permissions. Undeclared access to environment secrets and external network destinations reduces transparency and can bypass user expectations or platform controls, increasing the risk of unauthorized data access or exfiltration if the skill is modified or misused.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 80% confidence
Finding: The skill description materially overstates some capabilities and omits others, creating a mismatch between advertised behavior and actual operations. This is dangerous because operators may authorize or trust the skill under false assumptions, while hidden or underdocumented actions such as modifying task descriptions or linking documents can lead to unintended data changes and weaken security review effectiveness.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill prominently documents create and update operations but does not warn that these commands can modify or overwrite live ClickUp data across workspaces. In an agent context, this increases the chance of unintended destructive actions, especially because the skill supports multi-workspace usage and broad CRUD functionality.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The setup instructions tell users to export a personal ClickUp API token but provide no warning that it is a sensitive credential with potentially broad access to workspace data. In practice, this can lead to token exposure through shell history, logs, screenshots, copied transcripts, or unsafe reuse in shared environments, enabling unauthorized access and modification of ClickUp resources.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The CLI exposes destructive delete operations directly and the client has multiple delete methods with no confirmation, guardrail, or dry-run capability. In an agent/automation setting managing many workspaces, a mistaken command, wrong ID, or prompt/parameter mix-up could cause irreversible deletion of project data.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal