ClawHub
Back to skill

Security audit

ClickUp MCP

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for ClickUp work, but its first-time setup tells users or agents to execute unverified remote installer scripts.

Review the installer source before running first-time setup, prefer an official signed or package-manager installation path when available, and confirm ClickUp write actions carefully because they can create tasks, comments, chat messages, or update tasks in the connected workspace.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:62
Finding

Unverified Remote Installer Executed Through Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 62
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux

Technical Analysis

The installation instruction pipes an HTTPS response directly into Bash. The remote script is executed without version pinning, cryptographic signature verification, checksum validation, local inspection, or a separate approval boundary.

Although installing the oo CLI supports the declared ClickUp MCP workflow, direct execution of a mutable network response exceeds the minimum privileges necessary for installation. The effective code can change after the Skill has been reviewed. Compromise of the installation endpoint, hosting infrastructure, domain, or network trust chain could therefore result in arbitrary shell commands being delivered to users following the documented setup process.

Attack Path

  1. A ClickUp MCP action fails because the oo CLI is unavailable.
  2. The user or agent follows the first-time setup instruction.
  3. curl retrieves the current response from https://cli.oomol.com/install.sh.
  4. The response is passed to Bash without being saved or verified.
  5. Bash executes every command supplied by the remote endpoint with the invoking user's permissions.
  6. A malicious or compromised response can access or modify any resources available to that user.

Impact Assessment

Successful exploitation provides arbitrary command execution with the privileges of the account running the command. This may permit access to readable local files and credentials, modification of user-owned data and configuration, installation of additional software, or further network activity. If a user independently runs the command from an elevated shell, the remote script would inherit those elevated privileges; the Skill itself does not explicitly request elevation.

Remediation
View remediation

Remediation Suggestions

  • Remove the curl | bash installation pattern.
  • Pin the CLI to an exact, reviewed release version.
  • Download the installer or release artifact to a local file rather than executing the network stream.
  • Publish and verify a cryptographic signature or a trusted SHA-256 checksum before execution.
  • Prefer an operating-system package manager or another distribution channel that performs integrity and provenance checks.
  • Display the downloaded artifact, expected version, source, and digest to the user and require explicit approval before execution.
  • Do not allow an agent to install the CLI automatically merely because a connector action failed.
  • Run installation with ordinary user privileges unless elevated privileges are demonstrably required.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:66
Finding

Unverified Remote Installer Executed Through PowerShell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 66
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The PowerShell setup instruction retrieves a mutable script with Invoke-RestMethod (irm) and immediately evaluates it with Invoke-Expression (iex). There is no pinned version, signature verification, checksum validation, downloaded-file inspection, or independent confirmation of the code to be executed.

This creates a direct remote code-execution channel. While installation of the oo CLI is related to the Skill's declared operation, evaluating an unverified response is not the least-privileged installation method. The executable payload can change after audit, and compromise of the remote endpoint or its delivery infrastructure could cause attacker-controlled PowerShell commands to run locally.

Attack Path

  1. A ClickUp MCP action fails because the oo CLI is not installed.
  2. The user or agent follows the documented Windows setup command.
  3. irm retrieves the current content of https://cli.oomol.com/install.ps1.
  4. The pipeline passes that content directly to iex.
  5. PowerShell evaluates the response in the current process with the invoking user's permissions.
  6. A malicious or compromised installer response can execute arbitrary commands and access resources available to that account.

Impact Assessment

Successful exploitation permits arbitrary PowerShell command execution under the invoking user's security context. Potential scope includes reading accessible files and credentials, modifying user data or configuration, installing additional components, and initiating further network operations. If the user independently invokes PowerShell with administrative rights, the downloaded script inherits those rights; the audited instructi ...[truncated 63 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the irm | iex installation pattern.
  • Pin the CLI to a specific reviewed release.
  • Download the PowerShell installer to disk and do not evaluate a network response directly.
  • Require an Authenticode signature from a trusted publisher or verify a separately published cryptographic digest before execution.
  • Prefer a trusted Windows package manager or signed installer with provenance and integrity validation.
  • Present the artifact source, version, signature status, and intended changes to the user before requesting explicit approval.
  • Prevent automatic installation in response to authentication, connection, or command failures.
  • Execute with standard-user privileges unless administrative access is explicitly justified and approved.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Confidence
96% confidence
Finding

The skill instructs the agent to install software by piping a remotely fetched script directly into a shell (curl ... | bash). This creates a supply-chain and remote code execution risk because any compromise of the hosting endpoint, TLS interception, DNS hijack, or malicious script change would execute arbitrary code on the user's system without review.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

Static analysis

No suspicious patterns detected.