ClawHub
Back to skill

Security audit

ClickUp MCP

Security checks for vulnerabilities and agentic risk

Overview

This ClickUp integration is purpose-aligned, but it asks users to extract and persist a long-lived ClickUp access token from another application's credential store without adequate safeguards.

Review this before installing if your ClickUp workspace contains sensitive business data. Only use it if you are comfortable granting the agent ClickUp read/write abilities, protect CLICKUP_TOKEN like a password, store it with restrictive permissions or a secret manager, avoid committing or syncing the .env file, and revoke or rotate the token if it may have been exposed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:36
Finding

Exposure and Insecure Plaintext Storage of a Long-Lived ClickUp OAuth Token

Content
View full analysis
Remediation
View remediation
`. - Add explicit warnings that the credential grants access to workspace data and must never be shared or committed. - Provide secure permission-setting and verification commands alongside any fallback `.env` workflow. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation explicitly instructs users to extract an OAuth access token from a local credentials store and place it into a persistent environment file, while also noting the token is long-lived. This materially increases the chance of credential leakage through shell history, misconfigured file permissions, backups, dotfile syncing, or accidental sharing, and the skill does not provide strong handling guidance or safer alternatives.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The skill tells users to re-extract bearer tokens from ~/.claude/.credentials.json, which is a credential source file, and reuse them externally. Encouraging direct harvesting of long-lived secrets from another application's credential store expands the attack surface and normalizes unsafe credential-access practices that can lead to unauthorized ClickUp workspace access if the token is exposed.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md
Tokens are long-lived (~10 years). If expired:
1. Re-run `/mcp` in Claude Code
2. Re-extract token from `~/.claude/.credentials.json`
3. Update `CLICKUP_TOKEN` in `.env`

## Available Tools (32)

Static analysis

No suspicious patterns detected.