ClawHub
Back to skill

Security audit

Monday.com Accountability

Security checks for vulnerabilities and agentic risk

Overview

The skill is meant to automate a Monday.com accountability board, but it grants broad recurring work, messaging, sub-agent delegation, and unsafe handling of board text and API inputs that users should review carefully.

Install only if you are comfortable giving this skill recurring authenticated access to a Monday.com board and letting it coordinate real work. Use a least-privilege Monday token, avoid storing broad tokens in ~/.openclaw/.env, review board Details/Doc text as untrusted input, and require explicit approval before code changes, sub-agent delegation, or outbound messages.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:137
Finding

Untrusted Monday.com Board Content Is Treated as Authoritative Agent Instructions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
monday-api.sh:28
Finding

GraphQL and JSON Injection Through Unsafely Interpolated Shell Arguments

Content
View full analysis
Remediation
View remediation
&2 exit 1 } local variables variables="$(jq -n \ --argjson item_id "$item_id" \ --arg body "$body" \ '{item_id: $item_id, body: $body}')" graphql_request \ 'mutation UpdateItem($item_id: ID!, $body: String!) { create_update(item_id: $item_id, body: $body) { id } }' \ "$variables" } ``` The exact GraphQL variable types should be verified against the current Monday.com API schema. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill description frames the capability as Monday.com accountability management, but the document authorizes much broader behavior and includes undeclared credential handling implications noted by the scanner. This mismatch is dangerous because users and orchestrators may approve or auto-activate the skill under a narrow trust assumption while it performs materially different actions and accesses credentials or local environment unexpectedly.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill expands from tracking accountability items into actually performing substantive work such as code changes, configuration changes, research, and outreach. This is dangerous because a board-management skill becomes a general operations agent, enabling high-impact actions under the guise of routine status management and increasing the chance of unauthorized changes or data exposure.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The script reads a secret token from a local .env file, which is a form of credential access. In an agent skill, that behavior is more dangerous because the tool can authenticate to a third-party service using local secrets the user may not have intended this specific skill to consume.

Content

Scanner excerpt · monday-api.sh (reported line 10)May include surrounding context.

sh
#   MONDAY_COL_STATUS       — column ID for status (default: color_mm0yr4nm)
set -euo pipefail

# Read token from env, then fallback to .env file
TOKEN="${MONDAY_API_TOKEN:-$(grep MONDAY_API_TOKEN ~/.openclaw/.env 2>/dev/null | cut -d= -f2 || echo '')}"
BOARD="${MONDAY_BOARD_ID:-}"
COL_LAST_CHECKED="${MONDAY_COL_LAST_CHECKED:-date_mm0y8p9j}"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · monday-api.sh (reported line 11)May include surrounding context.

sh
set -euo pipefail

# Read token from env, then fallback to .env file
TOKEN="${MONDAY_API_TOKEN:-$(grep MONDAY_API_TOKEN ~/.openclaw/.env 2>/dev/null | cut -d= -f2 || echo '')}"
BOARD="${MONDAY_BOARD_ID:-}"
COL_LAST_CHECKED="${MONDAY_COL_LAST_CHECKED:-date_mm0y8p9j}"
COL_STATUS="${MONDAY_COL_STATUS:-color_mm0yr4nm}"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · monday-api.sh (reported line 18)May include surrounding context.

sh
API="https://api.monday.com/v2"

if [ -z "$TOKEN" ]; then
  echo "Error: MONDAY_API_TOKEN not set and not found in ~/.openclaw/.env" >&2
  exit 1
fi

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill enables shell-based helper script execution (scripts/monday-api.sh) and operational behavior, but it does not declare any tool scope or allowed-tools constraints. That creates an authorization gap where an agent may invoke broader local capabilities than users expect, increasing the chance of unintended command execution or access to local resources.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The activation text is broad enough to match common requests about assignments, status, work sessions, and cron-triggered activity. Over-broad triggering is dangerous because it can invoke this powerful skill in contexts where the user only wanted discussion or lightweight assistance, causing unnecessary external actions or operational work.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Authorizing the agent to spawn sub-agents or coding agents materially expands the execution surface beyond Monday.com task tracking. In context, this can cause unreviewed delegation of sensitive context and operational authority to additional agents, amplifying mistakes, data leakage, or unsafe code changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill directs the agent to contact people for help or escalation without an explicit user-facing warning or consent checkpoint for outbound communication. In practice, this can result in unintended disclosure of internal context, project details, or blockers to external recipients.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs the agent to message people and the owner, which extends behavior beyond board management into outbound communications. That is risky because it can disclose project state, blockers, or sensitive details to third parties without an explicit, narrowly defined authorization model.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script silently falls back to reading a Monday API token from ~/.openclaw/.env, which expands the credential access surface beyond explicit runtime inputs. In an agent skill context, this can cause the skill to use locally stored secrets without clear user awareness or consent, enabling unintended credential use and account actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Accessing a local .env file for credentials without prominent disclosure is risky because users may not realize the skill is capable of reading secrets from disk. In a tool-executing agent environment, hidden credential sourcing weakens transparency and can lead to unauthorized use of a user's Monday.com account.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
BOARD="${MONDAY_BOARD_ID:-}"
COL_LAST_CHECKED="${MONDAY_COL_LAST_CHECKED:-date_mm0y8p9j}"
COL_STATUS="${MONDAY_COL_STATUS:-color_mm0yr4nm}"
API="https://api.monday.com/v2"

if [ -z "$TOKEN" ]; then
  echo "Error: MONDAY_API_TOKEN not set and not found in ~/.openclaw/.env" >&2

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · monday-api.sh (reported line 15)May include surrounding context.

sh
BOARD="${MONDAY_BOARD_ID:-}"
COL_LAST_CHECKED="${MONDAY_COL_LAST_CHECKED:-date_mm0y8p9j}"
COL_STATUS="${MONDAY_COL_STATUS:-color_mm0yr4nm}"
API="https://api.monday.com/v2"

if [ -z "$TOKEN" ]; then
  echo "Error: MONDAY_API_TOKEN not set and not found in ~/.openclaw/.env" >&2

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · monday-api.sh (reported line 28)May include surrounding context.

sh
fi

query() {
  curl -s -X POST "$API" \
    -H "Content-Type: application/json" \
    -H "Authorization: $TOKEN" \
    -d "{\"query\": \"$1\"}"