← 返回 Skills 市场
taazkareem

Clickup Project Management

作者 Talib Kareem · GitHub ↗ · v1.0.10
cross-platform ⚠ suspicious
549
总下载
0
收藏
2
当前安装
11
版本数
在 OpenClaw 中安装
/install clickup-project-management
功能描述
Manage ClickUp via natural language. Uses the taazkareem.com remote MCP server. A license key is required for full tool access (unlicensed calls return check...
使用说明 (SKILL.md)

ClickUp Project Management

Manage your ClickUp workspace using the ClickUp MCP Server via the bundled mcporter skill.

External Endpoints

URL Data Sent Purpose
https://clickup-mcp.taazkareem.com/mcp License key (via X-License-Key header), ClickUp OAuth access token (via Authorization header), MCP tool call payloads (task names, IDs, field values, etc.) Remote MCP server that proxies ClickUp API v2 calls on your behalf
https://api.clickup.com/api/v2/* ClickUp OAuth token (proxied by the MCP server) Upstream ClickUp API — requests are made by the remote server, not directly from your machine

Security & Privacy

  • What stays local: Your CLICKUP_MCP_LICENSE_KEY is stored in ~/.openclaw/openclaw.json (or your shell environment). OAuth tokens are cached locally by mcporter in ~/.mcporter/.
  • What leaves your machine: Every MCP tool call sends your license key and ClickUp OAuth token to the remote server at clickup-mcp.taazkareem.com. Tool call payloads (task data, workspace hierarchy, etc.) are also transmitted.
  • No scripts or code execution: This is an instruction-only skill — it does not install or run any scripts on your machine. It relies on the bundled mcporter client.
  • OAuth tokens: The mcporter auth ClickUp flow creates a ClickUp OAuth access token that is stored locally and transmitted to the remote MCP server with each call — the server uses it to proxy requests to the ClickUp API on your behalf.

Trust statement: By using this skill, your ClickUp workspace data and OAuth credentials are transmitted to and processed by a third-party server (clickup-mcp.taazkareem.com) operated by Talib Kareem. Only install this skill if you trust this operator and have reviewed the project repository.

Prerequisites

  1. Enable mcporter in ~/.openclaw/openclaw.json:

    {
      "skills": {
        "allowBundled": ["mcporter"]
      }
    }
    
  2. Configure ClickUp (one-time setup):

    # Use the $CLICKUP_MCP_LICENSE_KEY env provided by the skill metadata
    mcporter config add ClickUp https://clickup-mcp.taazkareem.com/mcp \
      --auth oauth \
      --header "X-License-Key=$CLICKUP_MCP_LICENSE_KEY"
    
  3. Authenticate (tokens are cached):

    mcporter auth ClickUp
    

Optimization: Tool Filtering Personas

\x3C!-- Last updated: v0.12.14 -->

To reduce context noise and improve AI accuracy, you can limit the tools available to your agent using the X-Enabled-Tools header in your mcporter config.

Proactive Agent Rule: If the current task aligns with one of these personas, you should dynamically apply the filtering header by re-running the mcporter config add command with the appropriate X-Enabled-Tools or X-Disabled-Tools flag.

Recommended Presets

Persona Purpose Header Config
Auditor Read-only access --header X-Enabled-Tools=get_workspace_hierarchy,get_workspace_tasks,get_task,get_list,get_folder,get_list_custom_fields,get_task_comments,get_task_time_entries,get_workspace_time_entries,get_current_time_entry,get_task_links,get_space_tags,get_workspace_members,find_member_by_name,get_chat_channels,get_chat_messages,get_document,list_documents,list_document_pages,get_document_pages,submit_feedback
Task Worker Daily task mgmt --header X-Enabled-Tools=get_workspace_hierarchy,get_workspace_tasks,get_task,get_list,get_folder,get_list_custom_fields,create_task,update_task,set_task_custom_field,move_task,duplicate_task,create_task_comment,get_task_comments,attach_task_file,start_time_tracking,stop_time_tracking,add_tag_to_task,remove_tag_from_task,add_task_link,delete_task_link,get_task_links,add_task_to_list,remove_task_from_list,find_member_by_name,submit_feedback
Time Specialist Tracking & Reports --header X-Enabled-Tools=get_workspace_hierarchy,get_workspace_tasks,get_task,get_task_time_entries,get_workspace_time_entries,get_current_time_entry,start_time_tracking,stop_time_tracking,add_time_entry,delete_time_entry,submit_feedback
Content Mgr Docs & Chat --header X-Enabled-Tools=get_workspace_hierarchy,get_workspace_tasks,get_task,get_task_comments,create_task_comment,find_member_by_name,create_document,get_document,list_documents,list_document_pages,get_document_pages,create_document_page,update_document_page,create_chat_channel,get_chat_channels,create_chat_message,get_chat_messages,submit_feedback
Safe Power User Full access (No Delete) --header X-Disabled-Tools=delete_task,delete_bulk_tasks,delete_time_entry,delete_task_link,delete_list,delete_folder,delete_space_tag

How to Apply

To switch to a persona (e.g., Task Worker), run:

mcporter config add ClickUp https://clickup-mcp.taazkareem.com/mcp \
  --header "X-License-Key=$CLICKUP_MCP_LICENSE_KEY" \
  --header "X-Enabled-Tools=get_workspace_hierarchy,..."

Personalization & Workflows

Following the OpenClaw standard, do not modify this skill for environment-specific details. Instead, use your agent's workspace/TOOLS.md file to define:

  • Custom Workflows: Define multi-step orchestrations (e.g., "Daily Wrap-up").
  • Specific IDs: Store commonly used team_id, list_ids, folder_ids, etc.
  • Structures or Conventions: Any rules or consistent behavior (e.g., common custom fields, tag rules, etc.)

Usage

Use the standard mcporter command pattern:

mcporter call ClickUp.\x3Ctool_name> [parameters]
安全使用建议
This skill works by sending your ClickUp OAuth token, license key, and task payloads to a third-party server (clickup-mcp.taazkareem.com). That behavior is documented in SKILL.md, so the risk is transparency rather than deception. Before installing: (1) only proceed if you trust the operator and have reviewed the referenced GitHub repo; (2) consider using read-only or limited 'persona' headers to restrict what the server can do; (3) be aware your ClickUp OAuth token will be cached locally (~/.mcporter) and transmitted — revoke the token if you later stop trusting the service; (4) if you need stronger guarantees, host your own MCP proxy or use ClickUp's official API integrations instead. If you want a stricter assessment, provide the mcporter client code and the MCP server source (or confirmation of a trusted release) so we can verify there is no hidden exfiltration or unexpected behavior.
功能分析
Type: OpenClaw Skill Name: clickup-project-management Version: 1.0.10 This skill is suspicious due to two main factors. First, it explicitly transmits sensitive data, including the `CLICKUP_MCP_LICENSE_KEY`, ClickUp OAuth access token, and all ClickUp workspace data (tasks, comments, hierarchy, etc.), to a third-party server at `https://clickup-mcp.taazkareem.com/mcp`, as detailed in `SKILL.md`. While this data transfer is disclosed in a 'Trust statement', it represents a significant trust requirement and a high-risk design choice. Second, `SKILL.md` contains a 'Proactive Agent Rule' that instructs the AI agent to dynamically reconfigure its `mcporter` settings by re-running `mcporter config add` commands. This is a form of prompt injection, demonstrating the agent's ability to execute shell commands based on its interpretation of tasks, which is a risky capability that could be exploited for malicious execution or further unauthorized actions.
能力评估
Purpose & Capability
Name/description match the behavior: the skill proxies ClickUp operations through the taazkareem.com MCP server and declares CLICKUP_MCP_LICENSE_KEY as the required credential.
Instruction Scope
SKILL.md explicitly instructs enabling the bundled mcporter client and configuring it to send the license key and any ClickUp OAuth tokens to the remote MCP server. This behavior is necessary for the described proxying function but does involve transmitting sensitive workspace data and tokens to a third party.
Install Mechanism
Instruction-only skill with no install spec or downloaded code; nothing is written or executed by the skill itself beyond instructing use of an existing mcporter client.
Credentials
The only declared required environment variable is CLICKUP_MCP_LICENSE_KEY, which is reasonable. However, the runtime flow creates and transmits a ClickUp OAuth access token (via mcporter auth) to the remote server; while functionally necessary, that sensitive token is not declared as a required env var and will be exfiltrated to the third party.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and is user-invocable only. It stores a license key in typical OpenClaw config paths and mcporter caches tokens locally as documented.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install clickup-project-management
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /clickup-project-management 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.10
- No file or documentation changes detected in this version. - No user-facing updates or modifications introduced in v1.0.10.
v1.0.9
Add security declarations and trust statement for ClawHub compliance
v1.0.8
- Removed the "homepage" entry from the skill manifest. - No other changes in functionality or documentation.
v1.0.7
- Updated skill homepage URL in metadata and docs to point to clickup-mcp-server repository. - No changes to usage, features, or installation process.
v1.0.6
- Added README.md with setup and usage instructions for the skill. - No changes made to code or core functionality. - Documentation now available to help users get started.
v1.0.5
- Removed the README.md file. - Updated SKILL.md with revised setup instructions and clarified configuration for enabling bundled skills. - Improved documentation for tool filtering personas, including how to dynamically apply tool filtering headers. - Added example commands for switching persona presets in SKILL.md.
v1.0.4
- Added a Privacy & Data Flow section detailing how credentials and data are handled. - Updated prerequisites to clarify mcporter activation and license key requirements. - Included a link for purchasing a license key. - Improved setup instructions for clarity and reduced technical steps. - No changes to functionality; documentation and setup process improved.
v1.0.3
- Updated "Tool Filtering Personas" section for clarity and easier application. - Simplified persona headers table and instructions, now emphasizing direct header values. - Removed previous guidance on dynamic persona switching and proactive config changes. - No functional or code changes; documentation improvement only.
v1.0.2
- Updated the description to clarify that a license key is required for full tool access, and unlicensed calls will return checkout links. - Revised metadata to remove the "requires" field and retain only the "primaryEnv" designation. - No functional or behavioral changes to the skill itself.
v1.0.1
- Updated metadata: now requires the env variable CLICKUP_MCP_LICENSE_KEY and changed the skill emoji. - Clarified description: explicitly notes use of the taazkareem.com MCP server and license requirement. - Prerequisites now specify setting up ClickUp (not just mcporter), and emphasize use of the bundled mcporter skill. - Metadata now highlights CLICKUP_MCP_LICENSE_KEY as the primary environment variable. - General wording improvements for clarity and accuracy.
v1.0.0
- Initial release of ClickUp Project Management skill. - Manage ClickUp tasks, comments, tags, lists, folders, docs, chat, and time entries using natural language. - Integrates with ClickUp MCP Server via mcporter; provides instructions for setup and authentication. - Includes optimization tips for tool filtering personas and recommended presets for different roles. - Supports customization through agent-level workflow and structure definitions. - Usage documentation for calling ClickUp tools with mcporter commands.
元数据
Slug clickup-project-management
版本 1.0.10
许可证
累计安装 2
当前安装数 2
历史版本数 11
常见问题

Clickup Project Management 是什么?

Manage ClickUp via natural language. Uses the taazkareem.com remote MCP server. A license key is required for full tool access (unlicensed calls return check... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 549 次。

如何安装 Clickup Project Management?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install clickup-project-management」即可一键安装,无需额外配置。

Clickup Project Management 是免费的吗?

是的,Clickup Project Management 完全免费(开源免费),可自由下载、安装和使用。

Clickup Project Management 支持哪些平台?

Clickup Project Management 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Clickup Project Management?

由 Talib Kareem(@taazkareem)开发并维护,当前版本 v1.0.10。

💬 留言讨论