Agent skill · security · jeremylongshore
clickup-security-basics
Harden ClickUp credentials, OAuth callbacks, Workspace boundaries, webhooks, logging, and incident response with least-privilege controls. Use when threat-modeling or reviewing a ClickUp integration. Trigger with "secure ClickUp", "ClickUp security review", or "ClickUp token rotation".
Why this skill is useful
Provides specific procedures and scripts for securing ClickUp API tokens and implementing least-privilege access that the AI wouldn't reliably generate on its own.
What it needs
Requires clickup account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
ClickUp Integration Security Overview Protect long-lived credentials and sensitive work content across outbound API calls, inbound webhooks, queues, logs, and operator tooling. Prerequisites A data-flow and trust-boundary diagram plus credential/Workspace inventory Named security, service, data, and ClickUp Workspace owners Synthetic fixtures and an incident/rotation runbook Tool Discipline Use Read, Glob, and Grep to inspect the repository, adapters, configuration names, tests, and evidence. Use WebFetch only for current official ClickUp documentation. Use Write or Edit after confirming the target file, Workspace boundary, and requested mode. Current Contract Personal tokens do not expire; OAuth tokens currently do not expire but that behavior is subject to change. OAuth Authorization Code callbacks require exact redirects, state validation, and server-side client-secret handling. Webhook requests use per-webhook secrets and raw-body HMAC-SHA256 in X-Signature; ClickUp has no fixed webhook source IP. API authorization reflects the user and authorized Workspaces, so the app must enforce its own tenant policy. Authentication Use a personal token only for accountable individual/testing work or OAuth Authorization Code for a user-facing integration. Inject the token server-side through a governed secret reference, send it in Authorization, verify authorized Workspace IDs, and never print the token, OAuth client secret, or webhook secret. Instructions 1. Inventory credentials, callbacks, Workspaces, scopes/capabilities, webhooks, queues, stores, logs, and operator access. 2. Remove client-side or repository secrets; inject environment-specific references at runtime. 3. Enforce OAuth state, exact redirect handling, Workspace allow-lists, and deny-by-default write policies. 4. Verify webhook signatures with constant-time comparison before JSON processing; apply replay/idempotency controls. 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/clickup-security-basics