T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:213- Finding
Untrusted Monday.com Content Is Propagated as Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Nova Accountability
Security checks for vulnerabilities and agentic risk
Overview
This skill is not clearly malicious, but it gives an agent broad recurring authority to act, delegate, and message people from Monday.com task content without enough boundaries.
Review before installing. Use a least-privilege Monday token limited to the intended board, avoid automatic cron execution until you add approval gates, restrict who the agent may message, and treat Monday item text as untrusted task data rather than instructions. The helper script should be hardened before relying on it for writes.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/monday-api.sh:27- Finding
Unsafe GraphQL and JSON Construction Allows Injection and Request Corruption
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The README expands the skill from Monday.com accountability management into broad autonomous action: executing work, making config changes, invoking coding agents, and sending messages. That creates a scope mismatch where operators may install a seemingly board-management skill that in practice authorizes much wider and potentially dangerous behavior, increasing the chance of unauthorized actions on code, systems, or communications.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README specifically instructs the agent to write code, delegate to other agents, and send messages, none of which are justified by the declared accountability-board role. In agent ecosystems, such instructions can be operationalized as authority, enabling lateral actions beyond the expected trust boundary and creating risk of unintended code changes or unsolicited external communication.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill's declared purpose understates important behavior, especially local credential access from ~/.openclaw/.env and broader operational actions beyond simple board management. Description-behavior mismatches are dangerous because they defeat informed consent and make reviewers and users underestimate what the skill can access or trigger.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation text is broad enough to trigger on vague phrases like being 'accountable for X' or general status questions, increasing the chance the skill runs in contexts the user did not intend. With this skill's expansive instructions, overbroad triggering materially raises the risk of autonomous actions, messaging, or work execution being initiated from ambiguous prompts.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
These instructions expand the skill from board tracking into arbitrary non-Monday task execution, code orchestration, and contacting other people. In context, that scope expansion is especially risky because the skill can pivot from passive project tracking into autonomous real-world actions without a clear per-action approval boundary.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # MONDAY_COL_STATUS — column ID for status (default: color_mm0yr4nm) set -euo pipefail # Read token from env, then fallback to .env file TOKEN="${MONDAY_API_TOKEN:-$(grep MONDAY_API_TOKEN ~/.openclaw/.env 2>/dev/null | cut -d= -f2 || echo '')}" BOARD="${MONDAY_BOARD_ID:-}" COL_LAST_CHECKED="${MONDAY_COL_LAST_CHECKED:-date_mm0y8p9j}"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # MONDAY_COL_STATUS — column ID for status (default: color_mm0yr4nm) set -euo pipefail # Read token from env, then fallback to .env file TOKEN="${MONDAY_API_TOKEN:-$(grep MONDAY_API_TOKEN ~/.openclaw/.env 2>/dev/null | cut -d= -f2 || echo '')}" BOARD="${MONDAY_BOARD_ID:-}" COL_LAST_CHECKED="${MONDAY_COL_LAST_CHECKED:-date_mm0y8p9j}"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh API="https://api.monday.com/v2" if [ -z "$TOKEN" ]; then echo "Error: MONDAY_API_TOKEN not set and not found in ~/.openclaw/.env" >&2 exit 1 fi
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The documentation emphasizes that the agent should do 'real work' rather than merely manage accountability status, which conflicts with the stated purpose of accountability-item management. This can cause downstream agents or users to interpret the skill as authorization to take substantive actions unrelated to board tracking, leading to unsafe overreach.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README describes autonomous code/config changes and messaging without a prominent user warning, despite these being materially higher-risk than simple Monday board updates. Lack of disclosure undermines informed consent and can cause users to enable the skill without understanding that it may modify systems or contact others autonomously.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Encouraging the agent to spawn sub-agents and message people broadens the skill from project tracking into autonomous orchestration and outbound communications. Even if framed as a design principle, this can normalize unsafe behavior and lead an agent to act on third-party systems or contact humans without explicit consent.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill implicitly expects shell capability via the helper script and operational instructions, but it does not declare any explicit tool scope or permissions boundary. This makes the skill harder to review and can lead an agent runtime to execute broader local actions than users would reasonably expect from a Monday.com board-management skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill tells the agent to message people who can help, including people beyond the owner, without a strong user-facing warning or approval requirement. This is dangerous because it can cause unauthorized outreach, disclosure of project context, and social-engineering style escalation under the guise of unblocking work.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The daily summary requires outbound reporting to the owner, which is a messaging capability not clearly bounded by the declared skill purpose. Even if benign, unannounced reporting can leak sensitive project details or normalize autonomous communications the user did not explicitly authorize.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md BOARD="${MONDAY_BOARD_ID:-}" COL_LAST_CHECKED="${MONDAY_COL_LAST_CHECKED:-date_mm0y8p9j}" COL_STATUS="${MONDAY_COL_STATUS:-color_mm0yr4nm}" API="https://api.monday.com/v2" if [ -z "$TOKEN" ]; then echo "Error: MONDAY_API_TOKEN not set and not found in ~/.openclaw/.env" >&2
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh BOARD="${MONDAY_BOARD_ID:-}" COL_LAST_CHECKED="${MONDAY_COL_LAST_CHECKED:-date_mm0y8p9j}" COL_STATUS="${MONDAY_COL_STATUS:-color_mm0yr4nm}" API="https://api.monday.com/v2" if [ -z "$TOKEN" ]; then echo "Error: MONDAY_API_TOKEN not set and not found in ~/.openclaw/.env" >&2
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh fi query() { curl -s -X POST "$API" \ -H "Content-Type: application/json" \ -H "Authorization: $TOKEN" \ -d "{\"query\": \"$1\"}"
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The example configuration sets the messaging timezone to Asia/Jerusalem, which imposes a locale-specific default in the natural-language documentation without explaining that users should choose their own locale. This can violate language/locale policy expectations when a specific locale is presented as the default behavior rather than an explicit user-selected option.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The credential setup explains how to obtain and use a Monday API token with board write access but does not warn users that the token is sensitive and grants modification capability. While common in setup docs, omission of token-handling guidance increases the chance of accidental exposure or over-privileged deployment.
- Content