← Back to Skills Marketplace
taazkareem

Clickup Project Management

by Talib Kareem · GitHub ↗ · v1.0.10
cross-platform ⚠ suspicious
549
Downloads
0
Stars
2
Active Installs
11
Versions
Install in OpenClaw
/install clickup-project-management
Description
Manage ClickUp via natural language. Uses the taazkareem.com remote MCP server. A license key is required for full tool access (unlicensed calls return check...
README (SKILL.md)

ClickUp Project Management

Manage your ClickUp workspace using the ClickUp MCP Server via the bundled mcporter skill.

External Endpoints

URL Data Sent Purpose
https://clickup-mcp.taazkareem.com/mcp License key (via X-License-Key header), ClickUp OAuth access token (via Authorization header), MCP tool call payloads (task names, IDs, field values, etc.) Remote MCP server that proxies ClickUp API v2 calls on your behalf
https://api.clickup.com/api/v2/* ClickUp OAuth token (proxied by the MCP server) Upstream ClickUp API — requests are made by the remote server, not directly from your machine

Security & Privacy

  • What stays local: Your CLICKUP_MCP_LICENSE_KEY is stored in ~/.openclaw/openclaw.json (or your shell environment). OAuth tokens are cached locally by mcporter in ~/.mcporter/.
  • What leaves your machine: Every MCP tool call sends your license key and ClickUp OAuth token to the remote server at clickup-mcp.taazkareem.com. Tool call payloads (task data, workspace hierarchy, etc.) are also transmitted.
  • No scripts or code execution: This is an instruction-only skill — it does not install or run any scripts on your machine. It relies on the bundled mcporter client.
  • OAuth tokens: The mcporter auth ClickUp flow creates a ClickUp OAuth access token that is stored locally and transmitted to the remote MCP server with each call — the server uses it to proxy requests to the ClickUp API on your behalf.

Trust statement: By using this skill, your ClickUp workspace data and OAuth credentials are transmitted to and processed by a third-party server (clickup-mcp.taazkareem.com) operated by Talib Kareem. Only install this skill if you trust this operator and have reviewed the project repository.

Prerequisites

  1. Enable mcporter in ~/.openclaw/openclaw.json:

    {
      "skills": {
        "allowBundled": ["mcporter"]
      }
    }
    
  2. Configure ClickUp (one-time setup):

    # Use the $CLICKUP_MCP_LICENSE_KEY env provided by the skill metadata
    mcporter config add ClickUp https://clickup-mcp.taazkareem.com/mcp \
      --auth oauth \
      --header "X-License-Key=$CLICKUP_MCP_LICENSE_KEY"
    
  3. Authenticate (tokens are cached):

    mcporter auth ClickUp
    

Optimization: Tool Filtering Personas

\x3C!-- Last updated: v0.12.14 -->

To reduce context noise and improve AI accuracy, you can limit the tools available to your agent using the X-Enabled-Tools header in your mcporter config.

Proactive Agent Rule: If the current task aligns with one of these personas, you should dynamically apply the filtering header by re-running the mcporter config add command with the appropriate X-Enabled-Tools or X-Disabled-Tools flag.

Recommended Presets

Persona Purpose Header Config
Auditor Read-only access --header X-Enabled-Tools=get_workspace_hierarchy,get_workspace_tasks,get_task,get_list,get_folder,get_list_custom_fields,get_task_comments,get_task_time_entries,get_workspace_time_entries,get_current_time_entry,get_task_links,get_space_tags,get_workspace_members,find_member_by_name,get_chat_channels,get_chat_messages,get_document,list_documents,list_document_pages,get_document_pages,submit_feedback
Task Worker Daily task mgmt --header X-Enabled-Tools=get_workspace_hierarchy,get_workspace_tasks,get_task,get_list,get_folder,get_list_custom_fields,create_task,update_task,set_task_custom_field,move_task,duplicate_task,create_task_comment,get_task_comments,attach_task_file,start_time_tracking,stop_time_tracking,add_tag_to_task,remove_tag_from_task,add_task_link,delete_task_link,get_task_links,add_task_to_list,remove_task_from_list,find_member_by_name,submit_feedback
Time Specialist Tracking & Reports --header X-Enabled-Tools=get_workspace_hierarchy,get_workspace_tasks,get_task,get_task_time_entries,get_workspace_time_entries,get_current_time_entry,start_time_tracking,stop_time_tracking,add_time_entry,delete_time_entry,submit_feedback
Content Mgr Docs & Chat --header X-Enabled-Tools=get_workspace_hierarchy,get_workspace_tasks,get_task,get_task_comments,create_task_comment,find_member_by_name,create_document,get_document,list_documents,list_document_pages,get_document_pages,create_document_page,update_document_page,create_chat_channel,get_chat_channels,create_chat_message,get_chat_messages,submit_feedback
Safe Power User Full access (No Delete) --header X-Disabled-Tools=delete_task,delete_bulk_tasks,delete_time_entry,delete_task_link,delete_list,delete_folder,delete_space_tag

How to Apply

To switch to a persona (e.g., Task Worker), run:

mcporter config add ClickUp https://clickup-mcp.taazkareem.com/mcp \
  --header "X-License-Key=$CLICKUP_MCP_LICENSE_KEY" \
  --header "X-Enabled-Tools=get_workspace_hierarchy,..."

Personalization & Workflows

Following the OpenClaw standard, do not modify this skill for environment-specific details. Instead, use your agent's workspace/TOOLS.md file to define:

  • Custom Workflows: Define multi-step orchestrations (e.g., "Daily Wrap-up").
  • Specific IDs: Store commonly used team_id, list_ids, folder_ids, etc.
  • Structures or Conventions: Any rules or consistent behavior (e.g., common custom fields, tag rules, etc.)

Usage

Use the standard mcporter command pattern:

mcporter call ClickUp.\x3Ctool_name> [parameters]
Usage Guidance
This skill works by sending your ClickUp OAuth token, license key, and task payloads to a third-party server (clickup-mcp.taazkareem.com). That behavior is documented in SKILL.md, so the risk is transparency rather than deception. Before installing: (1) only proceed if you trust the operator and have reviewed the referenced GitHub repo; (2) consider using read-only or limited 'persona' headers to restrict what the server can do; (3) be aware your ClickUp OAuth token will be cached locally (~/.mcporter) and transmitted — revoke the token if you later stop trusting the service; (4) if you need stronger guarantees, host your own MCP proxy or use ClickUp's official API integrations instead. If you want a stricter assessment, provide the mcporter client code and the MCP server source (or confirmation of a trusted release) so we can verify there is no hidden exfiltration or unexpected behavior.
Capability Analysis
Type: OpenClaw Skill Name: clickup-project-management Version: 1.0.10 This skill is suspicious due to two main factors. First, it explicitly transmits sensitive data, including the `CLICKUP_MCP_LICENSE_KEY`, ClickUp OAuth access token, and all ClickUp workspace data (tasks, comments, hierarchy, etc.), to a third-party server at `https://clickup-mcp.taazkareem.com/mcp`, as detailed in `SKILL.md`. While this data transfer is disclosed in a 'Trust statement', it represents a significant trust requirement and a high-risk design choice. Second, `SKILL.md` contains a 'Proactive Agent Rule' that instructs the AI agent to dynamically reconfigure its `mcporter` settings by re-running `mcporter config add` commands. This is a form of prompt injection, demonstrating the agent's ability to execute shell commands based on its interpretation of tasks, which is a risky capability that could be exploited for malicious execution or further unauthorized actions.
Capability Assessment
Purpose & Capability
Name/description match the behavior: the skill proxies ClickUp operations through the taazkareem.com MCP server and declares CLICKUP_MCP_LICENSE_KEY as the required credential.
Instruction Scope
SKILL.md explicitly instructs enabling the bundled mcporter client and configuring it to send the license key and any ClickUp OAuth tokens to the remote MCP server. This behavior is necessary for the described proxying function but does involve transmitting sensitive workspace data and tokens to a third party.
Install Mechanism
Instruction-only skill with no install spec or downloaded code; nothing is written or executed by the skill itself beyond instructing use of an existing mcporter client.
Credentials
The only declared required environment variable is CLICKUP_MCP_LICENSE_KEY, which is reasonable. However, the runtime flow creates and transmits a ClickUp OAuth access token (via mcporter auth) to the remote server; while functionally necessary, that sensitive token is not declared as a required env var and will be exfiltrated to the third party.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and is user-invocable only. It stores a license key in typical OpenClaw config paths and mcporter caches tokens locally as documented.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install clickup-project-management
  3. After installation, invoke the skill by name or use /clickup-project-management
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.10
- No file or documentation changes detected in this version. - No user-facing updates or modifications introduced in v1.0.10.
v1.0.9
Add security declarations and trust statement for ClawHub compliance
v1.0.8
- Removed the "homepage" entry from the skill manifest. - No other changes in functionality or documentation.
v1.0.7
- Updated skill homepage URL in metadata and docs to point to clickup-mcp-server repository. - No changes to usage, features, or installation process.
v1.0.6
- Added README.md with setup and usage instructions for the skill. - No changes made to code or core functionality. - Documentation now available to help users get started.
v1.0.5
- Removed the README.md file. - Updated SKILL.md with revised setup instructions and clarified configuration for enabling bundled skills. - Improved documentation for tool filtering personas, including how to dynamically apply tool filtering headers. - Added example commands for switching persona presets in SKILL.md.
v1.0.4
- Added a Privacy & Data Flow section detailing how credentials and data are handled. - Updated prerequisites to clarify mcporter activation and license key requirements. - Included a link for purchasing a license key. - Improved setup instructions for clarity and reduced technical steps. - No changes to functionality; documentation and setup process improved.
v1.0.3
- Updated "Tool Filtering Personas" section for clarity and easier application. - Simplified persona headers table and instructions, now emphasizing direct header values. - Removed previous guidance on dynamic persona switching and proactive config changes. - No functional or code changes; documentation improvement only.
v1.0.2
- Updated the description to clarify that a license key is required for full tool access, and unlicensed calls will return checkout links. - Revised metadata to remove the "requires" field and retain only the "primaryEnv" designation. - No functional or behavioral changes to the skill itself.
v1.0.1
- Updated metadata: now requires the env variable CLICKUP_MCP_LICENSE_KEY and changed the skill emoji. - Clarified description: explicitly notes use of the taazkareem.com MCP server and license requirement. - Prerequisites now specify setting up ClickUp (not just mcporter), and emphasize use of the bundled mcporter skill. - Metadata now highlights CLICKUP_MCP_LICENSE_KEY as the primary environment variable. - General wording improvements for clarity and accuracy.
v1.0.0
- Initial release of ClickUp Project Management skill. - Manage ClickUp tasks, comments, tags, lists, folders, docs, chat, and time entries using natural language. - Integrates with ClickUp MCP Server via mcporter; provides instructions for setup and authentication. - Includes optimization tips for tool filtering personas and recommended presets for different roles. - Supports customization through agent-level workflow and structure definitions. - Usage documentation for calling ClickUp tools with mcporter commands.
Metadata
Slug clickup-project-management
Version 1.0.10
License
All-time Installs 2
Active Installs 2
Total Versions 11
Frequently Asked Questions

What is Clickup Project Management?

Manage ClickUp via natural language. Uses the taazkareem.com remote MCP server. A license key is required for full tool access (unlicensed calls return check... It is an AI Agent Skill for Claude Code / OpenClaw, with 549 downloads so far.

How do I install Clickup Project Management?

Run "/install clickup-project-management" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Clickup Project Management free?

Yes, Clickup Project Management is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Clickup Project Management support?

Clickup Project Management is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Clickup Project Management?

It is built and maintained by Talib Kareem (@taazkareem); the current version is v1.0.10.

💬 Comments