Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward ClickUp task-management skill, but it can use your ClickUp token to read and change task data when invoked.
Install only if you intend to let the agent access ClickUp with the configured token. Treat CLICKUP_API_TOKEN as a secret, prefer environment or managed secret storage, and verify list IDs, task IDs, and requested status changes before allowing create or update actions.
This markdown file includes examples for creating tasks and updating task status via the ClickUp API, which can change user project data in an external system. The skill description does not include any warning or user disclosure about these write operations or their impact on workspace data.
The skill reads credentials from a local file outside its own directory tree (../../../clawd/TOOLS.md), which expands its access to unrelated local secrets beyond what is necessary for ClickUp operations. This creates unnecessary secret-discovery behavior and can silently consume credentials from a broader host context without clear user consent or scoping.
The skill automatically loads sensitive API credentials from local files or environment variables and immediately uses them for outbound API access without any user-facing disclosure. In an agent skill context, hidden credential use reduces transparency and can cause users to unknowingly authorize access to workspace data.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
}
const { apiToken, workspaceId } = getCredentials();
const BASE_URL = 'https://api.clickup.com/api/v2';
/**
* Make a request to ClickUp API
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
}
const { apiToken, workspaceId } = getCredentials();
const BASE_URL = 'https://api.clickup.com/api/v2';
/**
* Make a request to ClickUp API
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
}
const { apiToken, workspaceId } = getCredentials();
const BASE_URL = 'https://api.clickup.com/api/v2';
/**
* Make a request to ClickUp API
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
}
const { apiToken, workspaceId } = getCredentials();
const BASE_URL = 'https://api.clickup.com/api/v2';
/**
* Make a request to ClickUp API
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
}
const { apiToken, workspaceId } = getCredentials();
const BASE_URL = 'https://api.clickup.com/api/v2';
/**
* Make a request to ClickUp API
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
}
const { apiToken, workspaceId } = getCredentials();
const BASE_URL = 'https://api.clickup.com/api/v2';
/**
* Make a request to ClickUp API
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
}
const { apiToken, workspaceId } = getCredentials();
const BASE_URL = 'https://api.clickup.com/api/v2';
/**
* Make a request to ClickUp API
The createTask and updateTaskStatus functions perform remote state-changing actions directly from tool invocation with no confirmation, approval gate, or dry-run option. In an agent environment, this increases the chance of unintended writes, task tampering, or abuse through prompt injection or operator error.
The file instructs users to configure CLICKUP_API_TOKEN, which is a sensitive credential, but does not warn that it grants access to ClickUp data or should be stored and used carefully. For markdown files, omission of privacy or system-integrity warnings around credential use is in scope.
The inline documentation suggests a generic credential source, while the actual code reads a hardcoded relative path '../../../clawd/TOOLS.md'. This is not just omitted detail: the comment implies a normal local config source, while the implementation reaches into an external project path, which materially changes the skill's behavior and trust boundary.
Detected: suspicious.env_credential_access