Monday Ops
Analysis
The skill is a coherent monday.com helper, but it merits review because it can make broad workspace changes, including deletes, schema changes, public boards, and arbitrary API mutations, without consistently requiring explicit confirmation.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
Trigger on phrases like "monday board", "create a task", "update status", "sprint summary", "move item"
Some trigger phrases are generic task-management language, so the agent could interpret a non-monday.com request as a monday.com operation unless it clarifies user intent.
`delete_item` | Permanently delete an item ... `delete_column` | Remove a column from a board ... `all_monday_api` | Execute arbitrary GraphQL queries/mutations ... Phase 3: Execute — Call the MCP tools in the planned order.
The skill exposes destructive and raw API mutation capabilities, then instructs the agent to execute planned tool calls without a consistent explicit-approval rule for deletes, schema changes, bulk edits, or arbitrary GraphQL mutations.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
Ask the user: ... Any specific team members to add? ... create_board(name="Project Name", board_kind="public")
The project-board workflow asks for project details and team members but defaults to creating a public board, which can broaden visibility beyond what the user intended.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
Fireflies: fireflies_get_summary(transcriptId) → extract action items ... create_update on each item with meeting context ... Gmail: create_draft(to=email, subject="Task Complete: [Item Name]", body=...)
The workflow examples move meeting transcript context and task/contact information across multiple providers, which is purpose-aligned but needs careful data-boundary handling.