Personal Task Tracking
v1.0.1Query and manage ClickUp via REST API and the local `scripts/query.sh` helper. Use when listing open or completed tasks, counting due work, looking up spaces...
⭐ 0· 89·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (ClickUp task querying/manipulation) align with the required binaries (bash, curl, jq), the declared env vars (CLICKUP_API_KEY, CLICKUP_TEAM_ID, CLICKUP_ASSIGNEE_ID), and the included helper script which calls ClickUp's API.
Instruction Scope
SKILL.md and scripts only call ClickUp's API endpoints and reference the three declared env vars. The README suggests echoing env values to verify them (echo $CLICKUP_API_KEY) — which is a user-operated action that can expose secrets in shell history or terminal output; recommend avoiding echoing secrets. The instructions do not read other system files nor contact unexpected remote endpoints.
Install Mechanism
Install spec is a single brew formula to install jq, a standard, known package manager and package. No arbitrary downloads or extracted archives are present.
Credentials
The three required env vars map directly to ClickUp usage: API token, team id, and assignee id. The declared primary credential is the ClickUp API key. There are no unrelated credentials requested.
Persistence & Privilege
The skill does not request always:true, does not modify other skills or system-wide settings, and has no install steps that persist beyond installing jq. It runs as an invoked helper script and requires explicit invocation.
Assessment
This skill appears coherent for ClickUp task management, but you should only provide a ClickUp API token with the minimum necessary scope. Avoid echoing the API key (the SKILL.md suggests echoing it) because that may expose it in terminal history — instead set env vars securely (for example via a shell profile read step or a secrets manager). Review and run the script in a controlled environment if you have sensitive data in ClickUp, since the helper fetches all tasks and could return large amounts of private data. If you install, consider using a short-lived or scoped token you can revoke if needed, and verify network traffic or token usage in your ClickUp account after first use.Like a lobster shell, security has layers — review code before you run it.
latestvk97fbhzymdj7ajpvqxacnpgd7s83zn43
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
⏫ Clawdis
Binsbash, curl, jq
EnvCLICKUP_API_KEY, CLICKUP_TEAM_ID, CLICKUP_ASSIGNEE_ID
Primary envCLICKUP_API_KEY
Install
Install jq (brew)
Bins: jq
brew install jq