Monday Ops

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:50 AM UTC
• Version: 0.1.1

Overview

The skill is mostly a disclosed monday.com operations helper, but it asks agents to make persistent workspace changes and cross-service updates with some broad triggers and insufficient confirmation around visibility and sensitive content.

Review this skill before installing if your monday.com workspace contains confidential, personnel, customer, or launch data. Use it only when you are comfortable with the agent creating and changing monday.com records, and ask it to confirm board visibility, exact data copied from meetings, and any Calendar, Gmail, or Fireflies action before execution.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/workflows.md:20

Finding

Public Board Visibility Is Used Without Explicit User Approval

Content

View full analysis

Vulnerability Details

File Location: references/workflows.md:20
Vulnerability Type: Public-by-default resource configuration
Risk Level: Medium

Vulnerable Code

text

create_board(name="Project Name", board_kind="public")

Technical Analysis

The project-setup workflow explicitly creates a monday.com board with board_kind="public" without first asking the user to select the board visibility. Public visibility is not necessary for the Skill's declared board-creation functionality and therefore exceeds the minimum access scope required.

Because subsequent workflow steps add groups, columns, tasks, assignments, due dates, and notes to the newly created board, the unsafe visibility choice can affect all information later stored on it. The broader instructions do not require the Agent to display or confirm the selected visibility before board creation.

Attack Path

1. A user asks the Agent to create a project board.
2. The Agent follows the project-setup workflow.
3. The Agent executes create_board with board_kind="public".
4. Tasks, assignments, deadlines, notes, or meeting-derived information are added to the board.
5. Workspace members outside the intended project audience may be able to view that information because of the board's public visibility.

No external attacker or privilege-escalation mechanism is established by the reviewed files. The exposure is limited by the monday.com workspace's membership and access model, but it may still grant unintended read access to a broader internal audience.

Impact Assessment

The vulnerable default can expose the full contents of a newly created board, including task names, project status, user assignments, dates, links, and notes. The scope is the affected monday.com board and any information subsequently added to it. Users with access to public boards in the workspace may obtain visibility that the requesting user did not intend to g ...[truncated 5 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the hardcoded public visibility from the generic workflow.
2. Ask the user to choose between private, shareable, and public visibility before creating a board.
3. If visibility is not specified, default to the most restrictive supported option, normally private.
4. Show the board name, intended members, and selected visibility in a confirmation prompt before creation.
5. Require separate confirmation before placing confidential meeting notes, personal information, customer data, or credentials on a broadly visible board.
6. After creation, report the effective visibility so the user can identify configuration mistakes immediately.

A safer workflow would use a confirmed variable rather than a fixed value:

text

Ask the user to select board visibility.
Default to "private" if no visibility is provided.
Confirm the selected visibility.
create_board(name="Project Name", board_kind=confirmed_visibility)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/workflows.md:209

Finding

Meeting Transcript Excerpts May Be Disclosed to monday.com Without Content-Level Confirmation

Content

View full analysis

Vulnerability Details

File Location: references/workflows.md:209-229
Vulnerability Type: Unconfirmed cross-service disclosure of potentially sensitive content
Risk Level: Medium

Vulnerable Code

text

## 6. Meeting Action Items → Board Items

**Trigger:** User says "create tasks from this meeting" or provides meeting notes / Fireflies transcript

### Steps

1. **Extract action items** from the meeting content
   - Look for patterns: "Action item:", "[Person] will...", "TODO:", "Follow up on..."
   - Extract: task description, assignee name, due date if mentioned

2. **Identify or create the target board**
   - Ask which board to add items to, or create a new one

3. **Discover board schema and resolve people**
   ```
   get_board_schema(board_id)
   list_users_and_teams(name="person name")  # For each mentioned person
   ```

4. **Create items with context**
   ```
   create_item(board_id, item_name, column_values={status, assignee, date})
   create_update(item_id, "Created from meeting: [Meeting Title]\nContext: [relevant excerpt]")
   ```

Technical Analysis

The workflow transfers a “relevant excerpt” from meeting notes or a Fireflies transcript into a monday.com item update. A request to create action items does not necessarily authorize copying underlying transcript content into another service or making it visible to every viewer of the destination board.

The workflow does not require the Agent to preview the exact excerpt, inspect it for secrets or personal information, verify the destination board's audience, or obtain explicit approval for the additional disclosure. This creates a data-minimization failure: task titles, assignees, and dates may be sufficient for the requested operation, while source excerpts introduce unnecessary sensitive context.

The network communication with the official monday.com MCP endpoint is consistent with the Skill's declared functional ...[truncated 1496 chars]

Remediation

View remediation

Remediation Suggestions

1. Default to creating only the minimum task fields required by the user, such as title, assignee, and due date.
2. Do not copy source excerpts unless the user explicitly requests contextual text.
3. Before posting an excerpt, show the exact content, destination board, destination item, and effective audience.
4. Require explicit confirmation for the cross-service transfer.
5. Scan and redact credentials, access tokens, private links, personal information, customer data, and unrelated confidential discussion.
6. Summarize sensitive context instead of reproducing transcript text verbatim.
7. Verify that the destination board's visibility and membership are appropriate for the source material.
8. Record only a non-sensitive source reference when possible, and avoid posting links that broaden access to the original transcript.

A safer sequence is:

text

Extract the task title, assignee, and due date.
Create a minimal preview for the user.
If contextual text is requested, redact sensitive data and preview the exact text.
Confirm the destination and its audience.
Post the approved content only after explicit confirmation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger description is extremely broad, covering many generic project-management phrases and even any reference to boards, tasks, columns, workflows, or board IDs. This raises the chance that the skill will activate in contexts where the user did not specifically intend monday.com operations, potentially steering the agent into connector-backed actions or data access on the wrong platform.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill’s stated scope is monday.com workspace operations, but it explicitly instructs the agent to branch into Gmail, Google Calendar, and Fireflies actions. That scope expansion can cause the agent to access or act on unrelated systems without a clear, narrowly scoped user request, increasing the risk of unintended data access, cross-system side effects, and over-privileged behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file defines activation triggers, so SQP-1 applies. The trigger 'User provides a list of tasks to create' and the phrase 'add these items to board X' are broad enough that ordinary task-oriented conversation could invoke the workflow without clear boundaries or exclusion conditions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The meeting-transcript workflow instructs the agent to extract action items from meeting content and create board items, potentially including sensitive business, personnel, or customer information. Without a warning or confirmation step, the skill can transform and persist sensitive transcript content into monday.com records, increasing exposure and retention.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The phrase "what's blocking the launch?" is a natural conversational request that does not clearly indicate this specific skill or that multiple monday.com boards will be queried. Without tighter context or exclusions, it risks unintended invocation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is scoped as a monday.com operations skill, but the workflow documentation expands into Google Calendar, Fireflies, and Gmail actions that move or act on data in external systems. This broadens the effective permission surface and can cause task, meeting, and contact data to be propagated outside monday.com without clear scope boundaries or explicit user consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented Google Calendar and Gmail actions perform external calendar and email operations even though the skill's stated purpose is monday.com workspace management. That mismatch can surprise users and lead to unintended disclosure of board content, due dates, assignee identities, or generated message content to third-party services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The Google Calendar integration sends monday.com task details, including item names and due dates, to an external service without any documented disclosure or approval step. This can expose project data outside the original system boundary and may violate user expectations or organizational data-handling policies.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The Gmail integration uses assignee email addresses and drafts outbound emails derived from monday.com item state, but it omits any warning that personal contact data and task context will be used in another system. This can lead to unintended disclosure, incorrect recipients, or unauthorized external communications generated from board data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.