Agent skill · data analytics · jeremylongshore
clickup-data-handling
Analyze, map, minimize, redact, retain, export, and delete ClickUp-derived work data under an application-owned governance policy. Use when ClickUp tasks, comments, attachments, or member data enter another system. Trigger with "ClickUp data handling", "ClickUp PII", or "ClickUp retention".
Why this skill is useful
Adds executable scripts for PII detection and redaction in ClickUp data that are not commonly found in public documentation.
What it needs
Requires typescript installed locally. Requires clickup account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
ClickUp Work-Data Governance Overview Treat ClickUp content as potentially sensitive and keep compliance obligations separate from unsupported API assumptions. Prerequisites A data-flow inventory covering tasks, descriptions, comments, attachments, members, webhooks, logs, and backups Authorized legal/security retention, deletion, residency, and access rules A scoped credential plus test fixtures that contain no real personal or confidential data Tool Discipline Use Read, Glob, and Grep to inspect the repository, adapters, configuration names, tests, and evidence. Use WebFetch only for current official ClickUp documentation. Use Write or Edit after confirming the target file, Workspace boundary, and requested mode. Current Contract API responses reflect what the authenticated user can access; access is not proof that downstream storage is permitted. Webhook payloads can include user and before/after data and must be classified before persistence. Do not invent a universal ClickUp GDPR export/delete endpoint; map each application copy and authorized API action. Evidence can retain counts, hashes, classifications, and deletion receipts without retaining work content. Authentication Use a personal token only for accountable individual/testing work or OAuth Authorization Code for a user-facing integration. Inject the token server-side through a governed secret reference, send it in Authorization, verify authorized Workspace IDs, and never print the token, OAuth client secret, or webhook secret. Instructions 1. Trace every ClickUp field from collection through processing, storage, logs, analytics, backups, and deletion. 2. Classify direct identifiers, free text, attachments, secrets, regulated content, and business metadata. 3. Minimize fields and scopes, redact telemetry, encrypt approved storage, and set retention by class. 4. Define subject/access/deletion workflows across ClickUp and each downstream copy with legal ownership. 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/clickup-data-handling