Monday
v1.0.0Access Monday.com API via Maton Gateway to manage boards, items, columns, groups, users, and workspaces using GraphQL with OAuth authentication.
⭐ 0· 29·0 current·0 all-time
byOtman Heddouch@otman-ai
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Suspicious
medium confidencePurpose & Capability
Skill name/description (Monday.com via Maton Gateway) match the runtime instructions (GraphQL calls to gateway.maton.ai and ctrl.maton.ai). However the registry metadata lists no required environment variables or primary credential while the SKILL.md repeatedly instructs callers to set MATON_API_KEY — an incoherence between claimed requirements and actual instructions. The skill's source/homepage are also missing, reducing provenance.
Instruction Scope
SKILL.md confines actions to HTTP POST GraphQL calls to gateway.maton.ai and connection management at ctrl.maton.ai, plus using MATON_API_KEY and an optional Maton-Connection header. It does not instruct reading local files or unrelated system state. It does instruct opening OAuth URLs in a browser (expected for OAuth flows).
Install Mechanism
Instruction-only skill with no install spec and no code files — nothing is downloaded or written to disk by an installer. This is lower risk from an installmechanism perspective.
Credentials
The only secret the instructions reference is MATON_API_KEY (appropriate for a gateway-based API), which is proportionate to the functionality. But the skill metadata fails to declare this required env var or a primary credential, which is an important mismatch: users and the platform may not be prompted for or protected around a secret the skill actually uses. Confirming exact credential scope (what the API key can do) is advisable.
Persistence & Privilege
Skill does not request always:true, does not declare modifying other skills or system configurations, and is user-invocable with normal autonomous invocation allowed. Nothing here grants unusual persistent privileges.
What to consider before installing
This skill is an instruction-only wrapper for the Maton gateway to talk to Monday.com; the SKILL.md instructs you to export MATON_API_KEY and to use ctrl.maton.ai/gateway.maton.ai endpoints. Before installing: (1) Verify the publisher/source and prefer official Monday.com or Maton-hosted integrations — provenance is missing here. (2) Confirm what privileges the MATON_API_KEY grants (which accounts/workspaces it can access) and use least-privilege credentials. (3) Be aware that the skill will send your data to maton.ai/ctrl.maton.ai; do not provide sensitive data you wouldn't want sent to that service. (4) Because the registry metadata omits the required MATON_API_KEY, ask the publisher or maintainer to correct the metadata so the platform can surface credential prompts and apply protections. If you cannot verify the skill's origin or the key's scope, treat it as untrusted.Like a lobster shell, security has layers — review code before you run it.
latestvk972ek8bbwvgg8m697wh39n0g9848q7x
License
MIT-0
Free to use, modify, and redistribute. No attribution required.