ClawHub
Back to skill

Security audit

Monday Direct

Security checks for vulnerabilities and agentic risk

Overview

This monday.com skill appears purpose-built for workspace API access, but it gives an agent broad authenticated read/write power with limited guardrails and a non-reproducible dependency install.

Review before installing. Use a least-privileged monday.com token, avoid storing or printing the token in prompts or logs, and treat create/update/delete-style requests as operations that should be explicitly confirmed. Prefer a pinned dependency and lockfile before using this in a sensitive workspace.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/package.json:12
Finding

Non-Reproducible Dependency Installation Through an Unpinned Version Range

Content
View full analysis

Vulnerability Details

File Location: scripts/package.json, line 12; related installation instructions in SKILL.md, lines 22–24
Vulnerability Type: Supply-chain risk caused by an unlocked dependency
Risk Level: Medium

Vulnerable Code

json
"dependencies": {
  "@mondaydotcomorg/api": "^14.0.0"
}

The documented installation process executes:

bash
npm install --prefix ~/.agents/skills/monday/scripts

No dependency lockfile is included in the audited project.

Technical Analysis

The caret constraint ^14.0.0 permits npm to install later compatible releases rather than the exact dependency version represented at audit time. Because the project does not include a lockfile, dependency resolution is not reproducible and may change between installations.

Although the dependency name and referenced sources appear to belong to the official monday.com client, future or compromised releases matching this range would not have been covered by this audit. npm may also execute dependency lifecycle scripts during installation. At runtime, the dependency receives the MONDAY_API_TOKEN through the client configuration, making dependency integrity particularly important.

Attack Path

  1. An attacker compromises the package publisher, registry delivery path, or a future package release that satisfies ^14.0.0.
  2. The user follows the documented npm install command.
  3. npm resolves the compromised release because no reviewed lockfile fixes the dependency graph.
  4. Malicious package code may execute through an npm lifecycle script during installation or when imported by scripts/monday.js.
  5. Runtime dependency code may access the Node.js process environment, including MONDAY_API_TOKEN, and may act with the operating-system privileges of the user running the Skill.

Impact Assessment

Successful exploitation could execute arbitrary code under the account installing or invoking the Skill. This may expose MONDAY_API_TOKEN, ...[truncated 466 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to an exact reviewed version rather than using a caret range:
json
"dependencies": {
  "@mondaydotcomorg/api": "14.0.0"
}
  1. Generate, review, and commit a package-lock.json so the complete dependency graph and integrity hashes are fixed.
  2. Replace the documented npm install workflow with npm ci, which installs strictly from the lockfile and fails if the manifest and lockfile disagree.
  3. Use npm ci --ignore-scripts when dependency lifecycle scripts are not required. If scripts are required, review them before installation.
  4. Run dependency vulnerability and provenance checks in CI, and use automated update tooling that subjects dependency changes to review and testing.
  5. Install and run the Skill with least privilege, and expose MONDAY_API_TOKEN only to the process that requires it.
  6. Rotate the monday.com token immediately if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares access to environment-provided secrets (MONDAY_API_TOKEN and optional endpoint variables) but does not define an explicit tool scope such as permissions or allowed-tools. In an agent setting, that makes the capability boundary ambiguous and increases the chance the skill is invoked with broader access than intended, especially because it can perform authenticated API actions against a user's monday.com workspace.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: monday
description: Interact directly with the monday.com GraphQL API — no third-party gateway required. Read and create boards, items, columns, updates, and users. Use when asked to check tasks, add items, update statuses, query boards, or do anything with a user's monday.com workspace.
homepage: https://github.com/mondaycom/monday-graphql-api
metadata:
  {

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The activation text is extremely broad: it tells the agent to use this skill for essentially anything involving a user's monday.com workspace. Overbroad routing language can cause the skill to be selected in situations where destructive or sensitive actions are not intended, increasing the risk of unauthorized reads, writes, or account-wide changes through the API.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The setup instructions describe how to place and inject the monday API token, but they do so without any warning about secret sensitivity, redaction, or avoiding echoing the token into logs, chat, commands, or config files with weak protections. Because this skill directly uses a high-value workspace token, careless handling could expose credentials that enable broad API access to boards, users, and mutations.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
92% confidence
Finding

The dependency uses a caret range (^14.0.0), which allows automatic installation of newer minor and patch releases. While common in JavaScript projects, this weakens supply-chain reproducibility and can expose the skill to a compromised or breaking upstream release without an explicit review. In a skill that directly interacts with a user's monday.com workspace, a malicious dependency update could affect API credentials, board data, or request handling.

Content

Scanner excerpt · scripts/package.json (reported line 12)May include surrounding context.

json
"node": ">= 18.0.0"
  },
  "dependencies": {
    "@mondaydotcomorg/api": "^14.0.0"
  }
}

Static analysis

No suspicious patterns detected.