ClawHub
Back to skill

Security audit

Monday Direct

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate monday.com API skill, but it gives an agent broad live workspace read and write authority through raw GraphQL without strong scoping or confirmation guidance.

Install only if you want the agent to have direct monday.com GraphQL access. Use a least-privileged token, keep it out of source control and logs, and manually confirm any create, update, delete, status-change, user, board, or column operation before it runs against a live workspace.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
83% confidence
Finding
The description uses very broad activation language such as 'do anything with a user's monday.com workspace,' which can cause the agent to invoke this skill for a wide range of requests with both read and write capability. In a skill backed by a live API token and mutation support, overbroad routing increases the chance of unintended data access or workspace modification.

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: monday
description: Interact directly with the monday.com GraphQL API — no third-party gateway required. Read and create boards, items, columns, updates, and users. Use when asked to check tasks, add items, update statuses, query boards, or do anything with a user's monday.com workspace.
homepage: https://github.com/mondaycom/monday-graphql-api
metadata:
  {
Confidence
78% confidence
Finding
This skill is designed to perform persistent actions against a real monday.com workspace, including creating and updating boards, items, columns, updates, and users. That persistence is expected for the product domain, but it is still a real security risk if invoked incorrectly because changes affect live organizational data and may be difficult to fully reverse.

Static analysis

No suspicious patterns detected.