monday
Fail
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [REMOTE_CODE_EXECUTION] (CRITICAL): The skill explicitly instructs users to execute remote scripts using the highly dangerous
curl | bashpattern. - Evidence:
curl -sSL https://canifi.com/skills/monday/install.sh | bashin the Quick Install section. - Evidence:
curl -sSL https://canifi.com/install.sh | bashin the Setup section. - [EXTERNAL_DOWNLOADS] (CRITICAL): The skill downloads and executes content from
canifi.com. This domain is not on the trusted source list, making the downloaded code unverifiable and potentially malicious. - [COMMAND_EXECUTION] (HIGH): The skill relies on shell command execution for its core installation and configuration, providing a large attack surface if the remote scripts are compromised.
- [CREDENTIALS_UNSAFE] (MEDIUM): The skill encourages users to store sensitive credentials like
SERVICE_PASSWORDandMONDAY_EMAILin environment variables via thecanifi-envtool. While it claims these are stored locally, the use of untrusted installation scripts makes these credentials highly vulnerable to exfiltration.
Recommendations
- HIGH: Downloads and executes remote code from: https://canifi.com/install.sh, https://canifi.com/skills/monday/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata