ClawHub
Back to skill

Security audit

Pa Onboarding

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent onboarding guide, but it asks users to connect sensitive business accounts and stores a monday.com token in an unsafe plaintext file.

Review this before installing or following it. Use a secret manager or a hardened credential file with owner-only permissions, avoid putting real tokens directly in shell commands, grant the agent account only the minimum monday.com and Google permissions needed, and ensure the owner explicitly approves any cron briefing, directory update, or public coordination announcement.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:93
Finding

Insecure Plaintext Storage of monday.com API Token

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 93–96
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: Medium

Vulnerable Code

markdown
3. Save the token:
   ```bash
   echo "YOUR_TOKEN" > ~/.credentials/monday-api-token.txt
text

### Technical Analysis

The onboarding instructions direct the user to place a monday.com API token in a plaintext file without first creating the containing directory securely or enforcing restrictive permissions on the resulting file.

The file's permissions will depend on the user's current `umask`. In an insecure environment, the token may therefore be readable by other local users or processes. Entering the token directly as part of the `echo` command may also cause the credential to be retained in shell history or captured through process or terminal monitoring.

Because monday.com API tokens generally inherit the associated account's permissions, disclosure could permit an unauthorized party to access or modify data available to the agent account.

### Attack Path

1. A user follows the documented onboarding command and substitutes a real API token for `YOUR_TOKEN`.
2. The command containing the token may be retained in shell history, while the output file is created with permissions determined by the current `umask`.
3. Another local user, compromised process, backup collector, or diagnostic tool accesses the command history or token file.
4. The party extracts the token and submits authenticated requests to the monday.com API.
5. The party reads or changes workspace resources within the compromised agent account's authorization scope.

### Impact Assessment

Successful exploitation grants the attacker the monday.com API privileges assigned to the agent account. Depending on that account's workspace role and board permissions, this may expose board content, items, updates, and other workspace metadata or permit unauthorized modifications.

The issue does not itself gran
...[truncated 153 chars]
Remediation
View remediation

Remediation Suggestions

Store the token in an operating-system keychain or a supported secret-management facility rather than a plaintext file.

If file-based storage is unavoidable:

  1. Create the credential directory with owner-only permissions.
  2. Read the token without displaying it or embedding it in shell history.
  3. Write the file under a restrictive umask.
  4. Explicitly set the token file to mode 0600.
  5. Remove the token from the shell environment immediately after writing it.
  6. Grant the monday.com account only the minimum workspace permissions required.
  7. Rotate the token immediately if it may already have been exposed.

Example hardened procedure:

bash
install -d -m 700 "$HOME/.credentials"
umask 077
read -rsp "monday.com token: " TOKEN
printf '\n'
printf '%s' "$TOKEN" > "$HOME/.credentials/monday-api-token.txt"
chmod 600 "$HOME/.credentials/monday-api-token.txt"
unset TOKEN

Avoid placing the literal token directly on a command line. Where available, use monday.com's supported secret integration or the platform's encrypted credential store.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (5)

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

This section explicitly instructs obtaining a monday.com access token and persisting it locally for later use. Because the token likely grants API access to organizational data and actions, exposure could allow unauthorized reading, modification, or automation against the monday.com workspace.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

Step 7: Connect monday.com

  1. Create a monday.com account for the agent (use org signup URL).
  2. Generate API token: avatar → Developers → My Access Tokens → Copy.
  3. Save the token:
    bash
    echo "YOUR_TOKEN" > ~/.credentials/monday-api-token.txt

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest description says to use the skill when "someone asks how to set up an agent" or when "guiding a user through the full setup process," which are broad natural-language conditions without clear scope boundaries. This can cause unintended invocation for generic setup questions that may not specifically be about this OpenClaw PA onboarding workflow.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md
## Phase 1 — Account & Agent (Do This First)

### Step 1: Create Agent Account
- Go to the agent signup page (for monday.com orgs: [monday.com/agents-signup](https://monday.com/agents-signup)).
- Sign in with organization SSO.
- Create the agent and give it a name.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Line L070 tells the operator to follow the whatsapp-diagnostics skill if the agent does not reply. Later, the document's own 'Lessons from Production' section explicitly says to never create a standalone diagnostics skill and even uses whatsapp-diagnostics as the example of what not to do, which is a direct contradiction in intent/documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill instructs saving a live monday.com API token in plaintext under ~/.credentials/monday-api-token.txt without any guidance on file permissions, secret storage, rotation, or least-privilege handling. This increases the chance of credential disclosure through local compromise, backups, shell history, accidental file sharing, or other skills/tools reading the file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.