{"data":{"skill":{"slug":"andresnaza-clickup-integration-expert","name":"ClickUp Integration Expert","icon":"📦","repo":"https://github.com/AndresNaza/claude-plugins/tree/main/clickup-sync/skills/clickup-integration","status":"approved","author":"AndresNaza","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"a7b60fd7-942a-46ed-a5f2-111c98d365a5","skill_id":"0a630540-f92c-4a6a-9f48-0ac8ff1500ff","version":7,"content_hash":"670db72dbd0877b7995394a07bd6984a","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"No prompt injection, hidden execution, or credential exfiltration was found. The external-command alerts are Markdown formatting or documented slash commands, and the ClickUp MCP URL is explicit setup guidance.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":35,"line_start":24},{"file":"SKILL.md","line_end":41,"line_start":35},{"file":"SKILL.md","line_end":42,"line_start":41},{"file":"SKILL.md","line_end":43,"line_start":42},{"file":"SKILL.md","line_end":44,"line_start":43},{"file":"SKILL.md","line_end":45,"line_start":44},{"file":"SKILL.md","line_end":46,"line_start":45},{"file":"SKILL.md","line_end":47,"line_start":46},{"file":"SKILL.md","line_end":52,"line_start":47},{"file":"SKILL.md","line_end":54,"line_start":52},{"file":"SKILL.md","line_end":56,"line_start":54},{"file":"SKILL.md","line_end":61,"line_start":56}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":53,"line_start":53}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":69,"audit_model":"codex","audited_at":"2026-07-06T03:29:47.27+00:00","created_at":"2026-07-06T04:26:50.886106+00:00","static_findings":[{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Stored in `.roadmap/clickup-config.json`:","category":"external_commands","line_end":22,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":35,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":41,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/clickup-sync:setup` | Configure ClickUp connection |","category":"external_commands","line_end":42,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/clickup-sync:push` | Push to ClickUp |","category":"external_commands","line_end":43,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/clickup-sync:pull` | Pull from ClickUp |","category":"external_commands","line_end":44,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/clickup-sync:sync` | Full bidirectional sync |","category":"external_commands","line_end":45,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/clickup-sync:status` | View sync status |","category":"external_commands","line_end":46,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/clickup-sync:link` | Manually link items |","category":"external_commands","line_end":47,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `/clickup-sync:unlink` | Remove sync links |","category":"external_commands","line_end":52,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":54,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":56,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Then run `/mcp` to authenticate via OAuth.","category":"external_commands","line_end":61,"severity":"medium","line_start":56},{"id":"network:SKILL.md:53:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"claude mcp add --transport http clickup https://mcp.clickup.com/mcp","category":"network","line_end":53,"severity":"low","line_start":53}],"finding_verdicts":[{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"This line describes a configuration file path using Markdown inline code. It is documentation, not Ruby or shell execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"This is an opening JSON code fence in Markdown. It contains no executable shell syntax and no dynamic command construction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"This is a closing Markdown code fence. It does not execute code or instruct the agent to run a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The backticks wrap a documented slash command name in a table. The skill does not execute Ruby or shell code from this text.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The backticks wrap a documented ClickUp sync slash command. This is user-facing command documentation, not shell execution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The backticks wrap a documented pull slash command. There is no shell interpolation, script body, or automatic command execution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"The backticks wrap a documented bidirectional sync slash command. It is descriptive Markdown, not executable Ruby or shell code.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The backticks wrap a documented status slash command. The line does not contain code execution or untrusted input handling.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"The backticks wrap a documented link slash command. It is a command label in Markdown, not a shell backtick expression.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"The backticks wrap a documented unlink slash command. The skill is not executing this text as Ruby or shell code.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"This is an opening bash code fence for a manual setup example. The static hit is the Markdown fence, not hidden execution by the skill.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"This is a closing Markdown code fence after a setup example. It has no executable behavior by itself.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"This line documents the manual /mcp authentication command after setup. It is visible user guidance, not automatic shell execution.","verdict":"false_positive","confidence":0.94},{"id":"network:SKILL.md:53:hardcoded-url","reason":"The URL is the explicit ClickUp MCP endpoint needed for OAuth setup. It matches the skill purpose and is not hidden exfiltration.","verdict":"false_positive","confidence":0.86}],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}