Audit History
ClickUp Integration Expert - 16 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v16 Latest | Jul 18, 2026, 10:03 AM | No confirmed findings | 0 | No capability change |
| v15 | Jul 17, 2026, 09:47 AM | No confirmed findings | 0 | No capability change |
| v14 | Jul 17, 2026, 09:47 AM | No confirmed findings | 0 | No capability change |
| v13 | Jul 17, 2026, 09:47 AM | No confirmed findings | 0 | No capability change |
| v12 | Jul 9, 2026, 08:37 AM | No confirmed findings | 1 | No capability change |
| v11 | Jul 9, 2026, 08:37 AM | No confirmed findings | 1 | No capability change |
| v10 | Jul 9, 2026, 05:57 AM | No confirmed findings | 1 | No capability change |
| v9 | Jul 9, 2026, 01:37 AM | No confirmed findings | 3 | No capability change |
| v8 | Jul 7, 2026, 08:04 PM | 1 confirmed | 2 | No capability change |
| v7 | Jul 6, 2026, 03:29 AM | No confirmed findings | 0 | External commands |
| v6 | Jun 28, 2026, 08:54 AM | No confirmed findings | 1 | External commands |
| v5 | Jan 16, 2026, 04:46 PM | No confirmed findings | 0 | No capability change |
| v4 | Jan 16, 2026, 04:46 PM | No confirmed findings | 0 | Network accessExternal commands |
| v3 | Jan 10, 2026, 10:17 AM | No confirmed findings | 0 | No capability change |
| v2 | Jan 10, 2026, 10:17 AM | No confirmed findings | 0 | No capability change |
| v1 | Jan 10, 2026, 10:17 AM | No confirmed findings | 0 | Baseline |
Jul 18, 2026, 10:03 AM
All 13 external-command findings are false positives caused by Markdown code fences and slash-command formatting. The documented MCP setup includes a visible ClickUp endpoint and OAuth step, with no evidence of concealed execution, credential exfiltration, or prompt injection.
Risk Factors
⚙️ External commands (13)
🌐 Network access (1)
Jul 17, 2026, 09:47 AM
All 13 external-command detections are false positives caused by Markdown code fences and inline command labels, not executable shell syntax. The remaining URL documents the official ClickUp MCP endpoint for an explicit user-run installation command; no prompt injection, secret collection, or covert data-exfiltration intent was found.
Risk Factors
⚙️ External commands (13)
🌐 Network access (1)
Jul 17, 2026, 09:47 AM
All 13 external-command detections are false positives caused by Markdown code fences and inline command labels, not executable shell syntax. The remaining URL documents the official ClickUp MCP endpoint for an explicit user-run installation command; no prompt injection, secret collection, or covert data-exfiltration intent was found.
Risk Factors
⚙️ External commands (13)
🌐 Network access (1)
Jul 17, 2026, 09:47 AM
All 13 external-command detections are false positives caused by Markdown code fences and inline command labels, not executable shell syntax. The remaining URL documents the official ClickUp MCP endpoint for an explicit user-run installation command; no prompt injection, secret collection, or covert data-exfiltration intent was found.
Risk Factors
⚙️ External commands (13)
🌐 Network access (1)
Jul 9, 2026, 08:37 AM
All Ruby/shell backtick detections are false positives caused by Markdown code fences, inline code, and slash-command documentation. The only confirmed issue is a low-severity external network dependency on the official ClickUp MCP URL, which is expected for the integration but requires user authorization.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
⚙️ External commands (13)
🌐 Network access (1)
Jul 9, 2026, 08:37 AM
All Ruby/shell backtick detections are false positives caused by Markdown code fences, inline code, and slash-command documentation. The only confirmed issue is a low-severity external network dependency on the official ClickUp MCP URL, which is expected for the integration but requires user authorization.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
⚙️ External commands (13)
🌐 Network access (1)
Jul 9, 2026, 05:57 AM
Most static findings are false positives caused by markdown code fences, inline slash commands, and configuration examples. The skill does include an intended setup command for a remote ClickUp MCP endpoint, so users should understand that it connects Claude to ClickUp through OAuth.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
⚙️ External commands (13)
🌐 Network access (1)
Jul 9, 2026, 01:37 AM
The static command findings are mostly markdown false positives from inline paths, fenced examples, and slash command documentation. The only confirmed risks are the documented external MCP setup command and hardcoded ClickUp MCP URL, which require user consent and endpoint verification but do not show malicious intent.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
⚙️ External commands (13)
🌐 Network access (1)
Jul 7, 2026, 08:04 PM
Most external command findings are false positives caused by Markdown backticks around paths, JSON examples, and slash commands. One documented CLI setup command and the hardcoded ClickUp MCP URL are real user-consent risks for adding a remote MCP integration.
Confirmed security concerns (1)
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
⚙️ External commands (13)
🌐 Network access (1)
Jul 6, 2026, 03:29 AM
No prompt injection, hidden execution, or credential exfiltration was found. The external-command alerts are Markdown formatting or documented slash commands, and the ClickUp MCP URL is explicit setup guidance.
Risk Factors
⚙️ External commands (13)
🌐 Network access (1)
Jun 28, 2026, 08:54 AM
The static external-command and weak-cryptography findings are false positives caused by Markdown code fences, inline command names, and table text. The only confirmed concern is a documented setup command that adds the official ClickUp MCP endpoint and requires OAuth, which is expected for this integration.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Risk Factors
🌐 Network access (1)
Jan 16, 2026, 04:46 PM
Pure prompt-based skill with no executable code. Only contains documentation about ClickUp integration patterns and MCP usage. No file access, network calls, or command execution capabilities. Static findings are false positives caused by the scanner misidentifying documentation formatting and JSON examples as security patterns.
Risk Factors
🌐 Network access (1)
Jan 16, 2026, 04:46 PM
Pure prompt-based skill with no executable code. Only contains documentation about ClickUp integration patterns and MCP usage. No file access, network calls, or command execution capabilities. Static findings are false positives caused by the scanner misidentifying documentation formatting and JSON examples as security patterns.
Risk Factors
🌐 Network access (1)
Jan 10, 2026, 10:17 AM
Pure prompt-based skill with no executable code. Only contains documentation about ClickUp integration patterns and MCP usage. No file access, network calls, or command execution capabilities.
Jan 10, 2026, 10:17 AM
Pure prompt-based skill with no executable code. Only contains documentation about ClickUp integration patterns and MCP usage. No file access, network calls, or command execution capabilities.
Jan 10, 2026, 10:17 AM
Pure prompt-based skill with no executable code. Only contains documentation about ClickUp integration patterns and MCP usage. No file access, network calls, or command execution capabilities.