clickup-automation

SUSPICIOUS: The skill is purpose-aligned and uses apparently official Rube/Composio infrastructure, so it does not look like malware or a fake installer. The main risk is data-flow integrity: all ClickUp access is routed through a third-party MCP broker instead of first-party ClickUp endpoints, giving Composio/Rube visibility and control over OAuth-backed project data and actions.