Ahc Automator
ReviewAudited by ClawScan on May 10, 2026.
Overview
This appears to be a real AHC automation tool, but it can automatically turn monitored emails into ClickUp and Pipedrive changes using business API tokens.
Install only if you control the AHC ClickUp, Pipedrive, and monitored email accounts and you want recurring automation. Before enabling cron jobs, verify the email sender rules, require approval for creating CRM/project records where needed, use scoped API tokens, and confirm how to disable the automation.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A keyword-matching email in the monitored mailboxes could create tasks, contacts, or deals in AHC systems without review.
Recent email content is used to trigger ClickUp task creation and Pipedrive deal creation automatically. The shown workflow does not include a human approval step or clear sender-authentication check before mutating business systems.
for email in emails:
self.process_single_email(email)
...
if self.email_parser.contains_keywords(email, 'clickup'):
self.handle_clickup_request(email)
...
task_result = self.clickup.create_task(...)
...
deal_result = self.pipedrive.create_deal(...)Add sender allowlists, deduplication, preview/approval for writes, and a rollback or audit process before creating or updating ClickUp/Pipedrive records.
If installed with broad API tokens, the skill can create or modify business records in ClickUp and Pipedrive.
The skill uses ClickUp and Pipedrive API tokens to act on connected business accounts. This is expected for the stated integration, but users should notice the delegated authority.
self.api_token = self.config.get_env_or_config('CLICKUP_API_TOKEN', 'clickup', 'api_token')
...
'Authorization': f'Bearer {self.api_token}'
...
self.api_token = self.config.get_env_or_config('PIPEDRIVE_API_TOKEN', 'pipedrive', 'api_token')Use least-privilege tokens where possible, keep tokens out of shared logs or shell profiles, and ensure the registry metadata clearly declares required credentials.
Once scheduled, the automation may continue processing emails and making business-system changes until the cron jobs are disabled.
The skill is designed to work with recurring background monitoring rather than only one manual run. This persistence is disclosed, but it affects ongoing business workflows.
Email monitoring is handled by existing cron jobs: - Ian: `ian@alanharpercomposites.com.br` (Every 5 minutes) - Ronaldo: `ronaldoaibot@gmail.com` (Every 5 minutes)
Confirm which cron jobs are active, document how to pause or remove them, and monitor the logs after installation.