clickup-multi-env-setup
Configures ClickUp API access for development, staging, and production environments with workspace isolation and token management.
Install this skill
Security score
The clickup-multi-env-setup skill was audited on May 18, 2026 and we found 19 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 89 | if (!value) throw new Error(`Missing required env var: ${key}`); |
Template literal with variable interpolation in command context
| 146 | `${operation} blocked in production. Set CLICKUP_ALLOW_DESTRUCTIVE=true to override.` |
Template literal with variable interpolation in command context
| 156 | `/list/${listId}/task?statuses[]=complete` |
Template literal with variable interpolation in command context
| 159 | await clickupRequest(`/task/${task.id}`, { method: 'DELETE' }); |
Template literal with variable interpolation in command context
| 166 | ```bash |
Curl to non-GitHub URL
| 182 | RESULT=$(curl -sf https://api.clickup.com/api/v2/user \ |
Access to .env file
| 53 | const env = process.env.NODE_ENV ?? 'development'; |
Access to .env file
| 81 | teamId: process.env.CLICKUP_TEAM_ID ?? '', |
Access to .env file
| 88 | const value = process.env[key]; |
Access to .env file
| 97 | # .env.development (local dev, git-ignored) |
Access to .env file
| 101 | # .env.staging (CI/CD only, git-ignored) |
Access to .env file
| 105 | # .env.production (secrets manager only, NEVER in files) |
Access to .env file
| 111 | # .env.example (commit this as template) |
Access to .env file
| 141 | const env = process.env.NODE_ENV ?? 'development'; |
Access to .env file
| 144 | if (env === 'production' && !process.env.CLICKUP_ALLOW_DESTRUCTIVE) { |
Access to .env file
| 198 | | Missing env var | Not configured | Check .env file or secrets manager | |
External URL reference
| 36 | **Key point:** All ClickUp API calls go to `https://api.clickup.com/api/v2/` regardless of environment. Environment isolation comes from using different tokens that are authorized for different worksp |
External URL reference
| 182 | RESULT=$(curl -sf https://api.clickup.com/api/v2/user \ |
External URL reference
| 205 | - [12-Factor App Config](https://12factor.net/config) |