clickup-api — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited clickup-api (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
ClickUp v3 quirks the team has been bitten by. Read before sending any message, creating any channel, or calling any ClickUp endpoint.
Forbidden: POST /chat/channels — creates a public channel visible to the entire 50+ person workspace. This has caused real noise/cleanup incidents.
Required pattern: POST /chat/channels/direct_message with user_ids — creates a private DM (1 user) or group DM (2+ users). All messaging to teammates routes through DMs, never new public channels.
Any ClickUp message sent to teammates via Claude — DM, group DM, thread reply, or channel post — MUST start with the 🧞 emoji. Lets recipients identify Claude-authored messages at a glance. Applies to all scripts, MCP tools, and direct API calls. No exceptions.
POST /chat/channels/direct_message body: {"user_ids": [<numeric>, ...]}POST /chat/channels/{id}/messages to send.POST /messages/{message_id}/repliesGET /chat/channels — paginated. Use the cursor from next_cursor field for the next page. total_count field returns the page size, not the full count — pages have has_more.If POST /chat/channels/direct_message returns 401/403 (the configured token may lack v3 chat-write scope), DO NOT block. Instead:
clickup_get_chat_channels.type=DM.clickup_get_chat_channel_messages, looking for the target user_id as sender.Reference incident: an existing teammate DM was identified this way on 2026-05-21 after v3 token auth failed.
The team_roster.json file contains stale entries for people who have left the company. Before tagging, mentioning, or sending outbound messages:
clickup_get_workspace_members or clickup_resolve_assignees).Do NOT assume a channel owner needs to reply to partner-channel messages unless they are directly tagged. Partner-channel messages should usually be handled by the CSM/support team. Filter untargeted partner-channel pings out of any triage workflow.
Full endpoint details in ~/.claude/reference/clickup-api.md.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.