monday
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
@useclawlink/clitool to interact with the Monday.com API. This is the primary method of operation and is expected behavior for this vendor's integration. - [EXTERNAL_DOWNLOADS]: The skill downloads the
@useclawlink/clipackage from the npm registry using npx. This is the official CLI tool provided by the skill author for this integration. - [CREDENTIALS_UNSAFE]: The skill instructions describe storing OAuth credentials in
~/.clawlink/credentials.jsonafter a browser-based authentication flow. This is a standard and secure practice for CLI tools to manage session tokens without requiring the user to handle raw API keys. - [PROMPT_INJECTION]: The instructions explicitly direct the agent to 'confirm with the user before any write', establishing a clear security boundary for actions taken based on data retrieved from the external service.
Audit Metadata