{"data":{"skill":{"slug":"andresnaza-clickup-integration-expert","name":"ClickUp Integration Expert","icon":"📦","repo":"https://github.com/AndresNaza/claude-plugins/tree/main/clickup-sync/skills/clickup-integration","status":"approved","author":"AndresNaza","authorVersion":null,"skillstoreRevision":3},"audit":{"id":"d05a44b7-01c1-48c8-b52d-38bf87b2dd53","skill_id":"0a630540-f92c-4a6a-9f48-0ac8ff1500ff","version":16,"content_hash":"v3:80999bf530a7874d7bedf8ce202001ecb4c4f5e0:759966b6513c3195172d73cad412dfd15053d3b9469633a311c542cda6c233b0:b8f5ad55154c584ab4fce2b3cbd34f734ac9f7ffabbab249e8e2e2391d53d8ed:736b696c6c732f616e647265736e617a612f636c69636b75702d696e746567726174696f6e2d657870657274:f04e37227cd74f77c15167b1160bbf2b","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 13 external-command findings are false positives caused by Markdown code fences and slash-command formatting. The documented MCP setup includes a visible ClickUp endpoint and OAuth step, with no evidence of concealed execution, credential exfiltration, or prompt injection.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":35,"line_start":24},{"file":"SKILL.md","line_end":41,"line_start":35},{"file":"SKILL.md","line_end":42,"line_start":41},{"file":"SKILL.md","line_end":43,"line_start":42},{"file":"SKILL.md","line_end":44,"line_start":43},{"file":"SKILL.md","line_end":45,"line_start":44},{"file":"SKILL.md","line_end":46,"line_start":45},{"file":"SKILL.md","line_end":47,"line_start":46},{"file":"SKILL.md","line_end":52,"line_start":47},{"file":"SKILL.md","line_end":54,"line_start":52},{"file":"SKILL.md","line_end":56,"line_start":54},{"file":"SKILL.md","line_end":61,"line_start":56}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":53,"line_start":53}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":69,"audit_model":"claude","audited_at":"2026-07-18T10:03:16.705+00:00","created_at":"2026-07-19T01:51:54.208088+00:00","static_findings":[{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Stored in `.roadmap/clickup-config.json`:","category":"external_commands","line_end":22,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":35,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":41,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/clickup-sync:setup` | Configure ClickUp connection |","category":"external_commands","line_end":42,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/clickup-sync:push` | Push to ClickUp |","category":"external_commands","line_end":43,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/clickup-sync:pull` | Pull from ClickUp |","category":"external_commands","line_end":44,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/clickup-sync:sync` | Full bidirectional sync |","category":"external_commands","line_end":45,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/clickup-sync:status` | View sync status |","category":"external_commands","line_end":46,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/clickup-sync:link` | Manually link items |","category":"external_commands","line_end":47,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/clickup-sync:unlink` | Remove sync links |","category":"external_commands","line_end":52,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":54,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":56,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Then run `/mcp` to authenticate via OAuth.","category":"external_commands","line_end":61,"severity":"medium","line_start":56},{"id":"network:SKILL.md:53:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"claude mcp add --transport http clickup https://mcp.clickup.com/mcp","category":"network","line_end":53,"severity":"low","line_start":53}],"finding_verdicts":[{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"The flagged text is Markdown formatting or a documented slash command name, not Ruby or shell backtick execution. No executable shell instruction appears at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The flagged text is Markdown formatting or a documented slash command name, not Ruby or shell backtick execution. No executable shell instruction appears at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"The flagged text is Markdown formatting or a documented slash command name, not Ruby or shell backtick execution. No executable shell instruction appears at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The flagged text is Markdown formatting or a documented slash command name, not Ruby or shell backtick execution. No executable shell instruction appears at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The flagged text is Markdown formatting or a documented slash command name, not Ruby or shell backtick execution. No executable shell instruction appears at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The flagged text is Markdown formatting or a documented slash command name, not Ruby or shell backtick execution. No executable shell instruction appears at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"The flagged text is Markdown formatting or a documented slash command name, not Ruby or shell backtick execution. No executable shell instruction appears at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The flagged text is Markdown formatting or a documented slash command name, not Ruby or shell backtick execution. No executable shell instruction appears at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"The flagged text is Markdown formatting or a documented slash command name, not Ruby or shell backtick execution. No executable shell instruction appears at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"The flagged text is Markdown formatting or a documented slash command name, not Ruby or shell backtick execution. No executable shell instruction appears at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"The flagged text is Markdown formatting or a documented slash command name, not Ruby or shell backtick execution. No executable shell instruction appears at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"The flagged text is Markdown formatting or a documented slash command name, not Ruby or shell backtick execution. No executable shell instruction appears at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"The flagged text is Markdown formatting or a documented slash command name, not Ruby or shell backtick execution. No executable shell instruction appears at this location.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:53:hardcoded-url","reason":"The URL is an explicit ClickUp MCP endpoint in a user-run setup command. The skill documents OAuth authentication and shows no hidden request or data transfer.","verdict":"false_positive","confidence":0.88}],"semantic_findings":[],"subject_marketplace_commit_sha":"80999bf530a7874d7bedf8ce202001ecb4c4f5e0","subject_content_hash":"759966b6513c3195172d73cad412dfd15053d3b9469633a311c542cda6c233b0","subject_tree_hash":"b8f5ad55154c584ab4fce2b3cbd34f734ac9f7ffabbab249e8e2e2391d53d8ed","subject_plugin_path":"skills/andresnaza/clickup-integration-expert","audit_payload_hash":"f04e37227cd74f77c15167b1160bbf2b","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"80999bf530a7874d7bedf8ce202001ecb4c4f5e0","contentHash":"759966b6513c3195172d73cad412dfd15053d3b9469633a311c542cda6c233b0","treeHash":"b8f5ad55154c584ab4fce2b3cbd34f734ac9f7ffabbab249e8e2e2391d53d8ed","pluginPath":"skills/andresnaza/clickup-integration-expert","auditPayloadHash":"f04e37227cd74f77c15167b1160bbf2b"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/andresnaza-clickup-integration-expert/audits/16/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}