Clickup Task

Create tasks in Vision Play ClickUp lists (visionplay or inbox).

This skill appears to do what it says (create ClickUp tasks) and only asks for a ClickUp token and list IDs, but the actual work is delegated to a server script (/usr/local/bin/clickup_create_task.sh) that is not included for review. Before installing or enabling this skill: 1) inspect the script at /usr/local/bin/clickup_create_task.sh to confirm it only calls the ClickUp API and does not read or transmit other data; 2) ensure the agent will properly escape or validate user-supplied title/description to prevent shell injection; 3) use a ClickUp token with minimal scope (dedicated service account or limited permissions) in case the script is compromised; and 4) if you cannot review the script, consider rejecting or requesting the skill author provide the script source or embed the minimal HTTP-curl logic in the skill bundle for auditability.

Type: OpenClaw Skill Name: clickup-task Version: 1.0.0 The skill bundle exhibits a critical shell injection vulnerability in SKILL.md, where user-provided inputs (list, title, description) are directly interpolated into a 'bash -lc' command string. Furthermore, the skill relies on an external script located at /usr/local/bin/clickup_create_task.sh which is not included in the bundle, preventing a full security audit of the execution logic. While these represent significant security risks, there is no clear evidence of intentional malice or data exfiltration.