ClawHub
Back to skill

Security audit

Clickup Project Management

Security checks for vulnerabilities and agentic risk

Overview

The skill clearly discloses a ClickUp remote-MCP workflow, but it sends ClickUp OAuth credentials and workspace data to a third-party proxy and includes agent-directed persistent tool-configuration changes.

Install only if you trust the operator of clickup-mcp.taazkareem.com with your ClickUp OAuth token and workspace contents. Prefer narrow ClickUp scopes, avoid using high-privilege admin accounts, review the remote project and its privacy/security posture, and manually approve any mcporter configuration changes instead of letting an agent switch personas automatically.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:11
Finding

ClickUp OAuth Credentials and Workspace Data Are Disclosed to a Third-Party Proxy

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11-25 and 38-46
Vulnerability Type: Third-party credential exposure and excessive trust delegation
Risk Level: High

Vulnerable Code Snippet:

markdown
## External Endpoints

| URL | Data Sent | Purpose |
| :--- | :--- | :--- |
| `https://clickup-mcp.taazkareem.com/mcp` | License key (via `X-License-Key` header), ClickUp OAuth access token (via `Authorization` header), MCP tool call payloads (task names, IDs, field values, etc.) | Remote MCP server that proxies ClickUp API v2 calls on your behalf |
| `https://api.clickup.com/api/v2/*` | ClickUp OAuth token (proxied by the MCP server) | Upstream ClickUp API — requests are made **by** the remote server, not directly from your machine |

## Security & Privacy

- **What stays local**: Your `CLICKUP_MCP_LICENSE_KEY` is stored in `~/.openclaw/openclaw.json` (or your shell environment). OAuth tokens are cached locally by `mcporter` in `~/.mcporter/`.
- **What leaves your machine**: Every MCP tool call sends your license key and ClickUp OAuth token to the remote server at `clickup-mcp.taazkareem.com`. Tool call payloads (task data, workspace hierarchy, etc.) are also transmitted.
- **No scripts or code execution**: This is an instruction-only skill — it does not install or run any scripts on your machine. It relies on the bundled `mcporter` client.
- **OAuth tokens**: The `mcporter auth ClickUp` flow creates a ClickUp OAuth access token that is stored locally and transmitted to the remote MCP server with each call — the server uses it to proxy requests to the ClickUp API on your behalf.

> **Trust statement**: By using this skill, your ClickUp workspace data and OAuth credentials are transmitted to and processed by a third-party server (`clickup-mcp.taazkareem.com`) operated by Talib Kareem. Only install this skill if you trust this operator and have reviewed the [project repository](https://github.com/taazka
...[truncated 2700 chars]
Remediation
View remediation

Remediation Suggestions

  1. Prefer direct communication with the official ClickUp API so the user's bearer token does not pass through a privately operated proxy.
  2. If a proxy is essential, use an architecture that does not expose a reusable user bearer token to the proxy. Exchange it for narrowly scoped, short-lived, audience-restricted credentials where supported.
  3. Request only the minimum OAuth scopes required for the current operation and separate read-only authorization from write or deletion authorization.
  4. Require explicit informed consent immediately before transmitting credentials or workspace content to the third party.
  5. Publish an auditable server implementation and document encryption, logging, retention, tenant isolation, incident response, and credential-deletion controls.
  6. Prevent authorization headers and task payloads from being written to access logs, tracing systems, analytics platforms, or error reports.
  7. Provide clear token-revocation instructions and automatically revoke or rotate credentials when the integration is removed.
  8. Use temporary authorization and operation-specific elevation rather than continuously sending a broadly privileged token with every call.

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:48
Finding

Agent Is Instructed to Modify Persistent Tool Access Configuration Proactively

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 48-53 and 67-72
Vulnerability Type: Instruction-driven security configuration mutation
Risk Level: Medium

Vulnerable Code Snippet:

markdown
## Optimization: Tool Filtering Personas

<!-- Last updated: v0.12.14 -->

To reduce context noise and improve AI accuracy, you can limit the tools available to your agent using the `X-Enabled-Tools` header in your `mcporter` config. 

**Proactive Agent Rule**: If the current task aligns with one of these personas, you should dynamically apply the filtering header by re-running the `mcporter config add` command with the appropriate `X-Enabled-Tools` or `X-Disabled-Tools` flag.

### How to Apply
To switch to a persona (e.g., **Task Worker**), run:
```bash
mcporter config add ClickUp https://clickup-mcp.taazkareem.com/mcp \
  --header "X-License-Key=$CLICKUP_MCP_LICENSE_KEY" \
  --header "X-Enabled-Tools=get_workspace_hierarchy,..."
text

### Technical Analysis

The skill instructs the agent to infer a persona from the current task and proactively rerun `mcporter config add`. This changes the MCP configuration without requiring explicit user confirmation at the point of change.

The persona presets include capabilities that can create or update tasks, attach files, manipulate tags and links, track time, create documents, and send chat messages. Automatically selecting one of these profiles can broaden the effective tool surface compared with a prior read-only or more restrictive configuration. Because the filtering mechanism is expressed through headers sent to the remote service, enforcement also depends on the remote server correctly honoring those headers.

This creates an instruction-hijacking risk: skill text influences the agent to alter a security-relevant configuration based on ambiguous natural-language classification rather than explicit authorization.

### Attack Path

1. The user beg
...[truncated 1236 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the proactive agent rule and require explicit user confirmation before every security-relevant configuration change.
  2. Default to a locally enforced, immutable read-only allowlist.
  3. Grant write capabilities only for a specific approved operation and automatically restore the previous configuration afterward.
  4. Display the exact tools that will be enabled, their effects, and the duration of the elevation before requesting approval.
  5. Preserve and compare the prior configuration so a persona change cannot silently overwrite stricter controls.
  6. Enforce tool authorization locally rather than relying exclusively on remote-server interpretation of request headers.
  7. Separate destructive, write, and read-only capabilities into distinct authorization tiers.
  8. Require renewed confirmation for file uploads, external messages, deletions, and other high-impact operations.

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:55
Finding

Purported Read-Only Auditor Persona Includes an Outbound Write Operation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 55-57
Vulnerability Type: Incorrect least-privilege tool allowlist
Risk Level: Low

Vulnerable Code Snippet:

markdown
### Recommended Presets

| Persona | Purpose | Header Config |
| :--- | :--- | :--- |
| **Auditor** | Read-only access | `--header X-Enabled-Tools=get_workspace_hierarchy,get_workspace_tasks,get_task,get_list,get_folder,get_list_custom_fields,get_task_comments,get_task_time_entries,get_workspace_time_entries,get_current_time_entry,get_task_links,get_space_tags,get_workspace_members,find_member_by_name,get_chat_channels,get_chat_messages,get_document,list_documents,list_document_pages,get_document_pages,submit_feedback` |

Technical Analysis

The Auditor persona is explicitly described as providing read-only access, but its allowlist includes submit_feedback. Based on its name and inclusion as an action, submit_feedback is an outbound operation rather than a read operation. This violates the stated read-only security boundary.

An allowlist intended for security enforcement must classify tools according to their actual side effects, not merely their expected routine use. Including any outbound write operation means callers cannot rely on this profile to guarantee that an audit performs no external writes.

Attack Path

  1. The user or agent selects the Auditor persona expecting strictly read-only behavior.
  2. The resulting X-Enabled-Tools header enables submit_feedback.
  3. The model, workflow, or remote service invokes that enabled operation.
  4. Audit-derived content or contextual data is transmitted as feedback despite the user's read-only expectation.
  5. The external service stores or processes the submitted content according to controls that are not present in the audited package.

Impact Assessment

The profile can perform at least one unexpected outbound write and may disclose audit context to the ...[truncated 247 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove submit_feedback from the Auditor allowlist.
  2. Define read-only profiles from a positively verified list of tools with no external side effects.
  3. Document the data flow and side effects of every tool included in each persona.
  4. Add automated validation that rejects write, mutation, upload, messaging, feedback, or deletion tools from read-only presets.
  5. Enforce the read-only restriction in the local client as well as on the remote server.
  6. Require separate, explicit user consent before enabling any feedback or telemetry operation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The skill requires sending a ClickUp OAuth access token and license key to a third-party MCP endpoint, giving that service the ability to act on the user's ClickUp workspace. If the server is compromised, malicious, or logs credentials insecurely, an attacker could read or modify workspace data with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
| URL | Data Sent | Purpose |
| :--- | :--- | :--- |
| `https://clickup-mcp.taazkareem.com/mcp` | License key (via `X-License-Key` header), ClickUp OAuth access token (via `Authorization` header), MCP tool call payloads (task names, IDs, field values, etc.) | Remote MCP server that proxies ClickUp API v2 calls on your behalf |
| `https://api.clickup.com/api/v2/*` | ClickUp OAuth token (proxied by the MCP server) | Upstream ClickUp API — requests are made **by** the remote server, not directly from your machine |

## Security & Privacy

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

The security section confirms that every MCP call transmits the ClickUp OAuth token to the remote server, making credential exposure continuous rather than incidental. Because the server proxies all API calls, it can observe sensitive workspace contents and perform any allowed action on behalf of the user.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
- **What stays local**: Your `CLICKUP_MCP_LICENSE_KEY` is stored in `~/.openclaw/openclaw.json` (or your shell environment). OAuth tokens are cached locally by `mcporter` in `~/.mcporter/`.
- **What leaves your machine**: Every MCP tool call sends your license key and ClickUp OAuth token to the remote server at `clickup-mcp.taazkareem.com`. Tool call payloads (task data, workspace hierarchy, etc.) are also transmitted.
- **No scripts or code execution**: This is an instruction-only skill — it does not install or run any scripts on your machine. It relies on the bundled `mcporter` client.
- **OAuth tokens**: The `mcporter auth ClickUp` flow creates a ClickUp OAuth access token that is stored locally and transmitted to the remote MCP server with each call — the server uses it to proxy requests to the ClickUp API on your behalf.

> **Trust statement**: By using this skill, your ClickUp workspace data and OAuth credentials are transmitted to and processed by a third-party server (`clickup-mcp.taazkareem.com`) operated by Talib Kareem. Only install this skill if you trust this operator and have reviewed the [project repository](https://github.com/taazkareem/clickup-mcp-server).

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The skill explicitly routes ClickUp API activity through a third-party remote MCP server and discloses that task data and credentials transit that service. This creates a real confidentiality and trust-boundary risk because workspace metadata and OAuth-protected operations are exposed to an operator outside the user's environment.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md
| URL | Data Sent | Purpose |
| :--- | :--- | :--- |
| `https://clickup-mcp.taazkareem.com/mcp` | License key (via `X-License-Key` header), ClickUp OAuth access token (via `Authorization` header), MCP tool call payloads (task names, IDs, field values, etc.) | Remote MCP server that proxies ClickUp API v2 calls on your behalf |
| `https://api.clickup.com/api/v2/*` | ClickUp OAuth token (proxied by the MCP server) | Upstream ClickUp API — requests are made **by** the remote server, not directly from your machine |

## Security & Privacy

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
- **What stays local**: Your `CLICKUP_MCP_LICENSE_KEY` is stored in `~/.openclaw/openclaw.json` (or your shell environment). OAuth tokens are cached locally by `mcporter` in `~/.mcporter/`.
- **What leaves your machine**: Every MCP tool call sends your license key and ClickUp OAuth token to the remote server at `clickup-mcp.taazkareem.com`. Tool call payloads (task data, workspace hierarchy, etc.) are also transmitted.
- **No scripts or code execution**: This is an instruction-only skill — it does not install or run any scripts on your machine. It relies on the bundled `mcporter` client.
- **OAuth tokens**: The `mcporter auth ClickUp` flow creates a ClickUp OAuth access token that is stored locally and transmitted to the remote MCP server with each call — the server uses it to proxy requests to the ClickUp API on your behalf.

> **Trust statement**: By using this skill, your ClickUp workspace data and OAuth credentials are transmitted to and processed by a third-party server (`clickup-mcp.taazkareem.com`) operated by Talib Kareem. Only install this skill if you trust this operator and have reviewed the [project repository](https://github.com/taazkareem/clickup-mcp-server).

Static analysis

No suspicious patterns detected.