clickup

Automates task management and project workflows in ClickUp using its API for enhanced productivity and integration.

Install this skill

or

0/100

Security score

The clickup skill was audited on May 15, 2026 and we found 47 security issues across 4 threat categories, including 1 high-severity. Review the findings below before installing.

Categories Tested

Security Issues

medium line 49

Template literal with variable interpolation in command context

SourceSKILL.md

49	const res = await fetch(`${BASE}${path}`, {

medium line 54

Template literal with variable interpolation in command context

SourceSKILL.md

54	if (!res.ok) throw new Error(`${res.status}: ${await res.text()}`);

high line 59

Template literal with variable interpolation in command context

SourceSKILL.md

59	For OAuth2 (multi-user), redirect to `https://app.clickup.com/api?client_id=${CLIENT_ID}&redirect_uri=${REDIRECT_URI}`, then exchange the code at `POST /api/v2/oauth/token`.

medium line 70

Template literal with variable interpolation in command context

SourceSKILL.md

70	const spaces = await clickup("GET", `/team/${teamId}/space?archived=false`);

medium line 73

Template literal with variable interpolation in command context

SourceSKILL.md

73	const folder = await clickup("POST", `/space/${spaceId}/folder`, { name: "Q1 2026 Roadmap" });

medium line 74

Template literal with variable interpolation in command context

SourceSKILL.md

74	const list = await clickup("POST", `/folder/${folderId}/list`, {

medium line 83

Template literal with variable interpolation in command context

SourceSKILL.md

83	const task = await clickup("POST", `/list/${listId}/task`, {

medium line 93

Template literal with variable interpolation in command context

SourceSKILL.md

93	`/list/${listId}/task?archived=false&order_by=due_date&statuses[]=in+progress&subtasks=true`);

medium line 96

Template literal with variable interpolation in command context

SourceSKILL.md

96	await clickup("PUT", `/task/${taskId}`, {

medium line 102

Template literal with variable interpolation in command context

SourceSKILL.md

102	await clickup("POST", `/list/${listId}/task`, { name: "Write tests", parent: parentTaskId });

medium line 103

Template literal with variable interpolation in command context

SourceSKILL.md

103	await clickup("POST", `/task/${taskId}/comment`, { comment_text: "Blocked by auth outage." });

medium line 104

Template literal with variable interpolation in command context

SourceSKILL.md

104	await clickup("POST", `/task/${taskId}/dependency`, { depends_on: blockingTaskId });

medium line 111

Template literal with variable interpolation in command context

SourceSKILL.md

111	const fields = await clickup("GET", `/list/${listId}/field`);

medium line 114

Template literal with variable interpolation in command context

SourceSKILL.md

114	await clickup("POST", `/task/${taskId}/field/${fieldId}`, { value: "option_uuid" });

medium line 115

Template literal with variable interpolation in command context

SourceSKILL.md

115	await clickup("POST", `/task/${taskId}/field/${numberFieldId}`, { value: 42 });

medium line 118

Template literal with variable interpolation in command context

SourceSKILL.md

118	await clickup("POST", `/task/${taskId}/time`, {

medium line 125

Template literal with variable interpolation in command context

SourceSKILL.md

125	`/team/${teamId}/time_entries?start_date=${Date.now() - 7 * 86400000}&end_date=${Date.now()}`);

medium line 132

Template literal with variable interpolation in command context

SourceSKILL.md

132	const goal = await clickup("POST", `/team/${teamId}/goal`, {

medium line 135

Template literal with variable interpolation in command context

SourceSKILL.md

135	await clickup("POST", `/goal/${goalId}/key_result`, {

medium line 140

Template literal with variable interpolation in command context

SourceSKILL.md

140	const webhook = await clickup("POST", `/team/${teamId}/webhook`, {

medium line 157

Template literal with variable interpolation in command context

SourceSKILL.md

157	await clickup("PUT", `/task/${task_id}`, { assignees: { add: [reviewerUserId] } });

medium line 180

Template literal with variable interpolation in command context

SourceSKILL.md

180

```yaml

medium line 39

Curl to non-GitHub URL

SourceSKILL.md

39	curl -s https://api.clickup.com/api/v2/user \

medium line 184

Curl to non-GitHub URL

SourceSKILL.md

184	curl -X POST "https://api.clickup.com/api/v2/list/${{ secrets.CLICKUP_BUG_LIST_ID }}/task" \

medium line 5

Webhook reference - potential data exfiltration

SourceSKILL.md

5	lists, and spaces via the ClickUp API, build automations and webhooks, create

medium line 9

Webhook reference - potential data exfiltration

SourceSKILL.md

9	webhooks, custom fields, automations, and reporting.

medium line 28

Webhook reference - potential data exfiltration

SourceSKILL.md

28	Automate and extend ClickUp — the all-in-one productivity platform. This skill covers the full ClickUp API v2 for managing workspaces, spaces, folders, lists, and tasks programmatically. Includes webh

medium line 128

Webhook reference - potential data exfiltration

SourceSKILL.md

128	### Step 5: Goals & Webhooks

low line 139

Webhook reference - potential data exfiltration

SourceSKILL.md

139	// Create a webhook

low line 140

Webhook reference - potential data exfiltration

SourceSKILL.md

140	const webhook = await clickup("POST", `/team/${teamId}/webhook`, {

low line 141

Webhook reference - potential data exfiltration

SourceSKILL.md

141	endpoint: "https://your-server.com/clickup/webhook",

medium line 146

Webhook reference - potential data exfiltration

SourceSKILL.md

146	Webhook handler (Express):

low line 148

Webhook reference - potential data exfiltration

SourceSKILL.md

148	app.post("/clickup/webhook", async (req, res) => {

low line 150

Webhook reference - potential data exfiltration

SourceSKILL.md

150	const hmac = crypto.createHmac("sha256", process.env.CLICKUP_WEBHOOK_SECRET!);

low line 172

Webhook reference - potential data exfiltration

SourceSKILL.md

172	await fetch(process.env.SLACK_WEBHOOK_URL!, {

medium line 200

Webhook reference - potential data exfiltration

SourceSKILL.md

200	User prompt: "Create a webhook that watches for urgent tasks in the Bug Triage list and notifies #oncall in Slack with the task name and assignee. Also set up a GitHub Actions step that auto-creat

medium line 202

Webhook reference - potential data exfiltration

SourceSKILL.md

202	The agent will create a ClickUp webhook scoped to the Bug Triage list listening for `taskPriorityUpdated` events. It will write an Express webhook handler that verifies the signature, checks if the ne

medium line 209

Webhook reference - potential data exfiltration

SourceSKILL.md

209	- Scope webhooks narrowly — use the optional `space_id`, `folder_id`, or `list_id` parameters when creating webhooks to avoid processing irrelevant events from the entire workspace.

medium line 210

Webhook reference - potential data exfiltration

SourceSKILL.md

210	- Validate webhook signatures — always verify the `x-signature` header using HMAC-SHA256 with your webhook secret before processing any payload to prevent spoofed requests.

low line 46

Access to .env file

SourceSKILL.md

46	const TOKEN = process.env.CLICKUP_API_TOKEN;

low line 150

Access to .env file

SourceSKILL.md

150	const hmac = crypto.createHmac("sha256", process.env.CLICKUP_WEBHOOK_SECRET!);

low line 172

Access to .env file

SourceSKILL.md

172	await fetch(process.env.SLACK_WEBHOOK_URL!, {

low line 39

External URL reference

SourceSKILL.md

39	curl -s https://api.clickup.com/api/v2/user \

low line 45

External URL reference

SourceSKILL.md

45	const BASE = "https://api.clickup.com/api/v2";

low line 59

External URL reference

SourceSKILL.md

59	For OAuth2 (multi-user), redirect to `https://app.clickup.com/api?client_id=${CLIENT_ID}&redirect_uri=${REDIRECT_URI}`, then exchange the code at `POST /api/v2/oauth/token`.

low line 141

External URL reference

SourceSKILL.md

141	endpoint: "https://your-server.com/clickup/webhook",

low line 184

External URL reference

SourceSKILL.md

184	curl -X POST "https://api.clickup.com/api/v2/list/${{ secrets.CLICKUP_BUG_LIST_ID }}/task" \

Scanned on May 15, 2026

View Security Dashboard

Installation guide →

GitHub Stars 51

Rate this skill

Categoryproject management

UpdatedMay 20, 2026

openclaw api project-manager operations-manager growth-marketer sdr customer-success-manager github slack clickup project management operations marketing sales

TerminalSkills/skills