monday-automation
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions direct the user to configure a remote MCP server endpoint at
https://rube.app/mcpto provide the tool definitions for Monday.com automation. - [COMMAND_EXECUTION]: The skill defines workflows that utilize a suite of tools for managing boards, items, and columns, including a raw GraphQL interface (
MONDAY_CREATE_OBJECT). - [PROMPT_INJECTION]: The skill has an indirect prompt injection surface due to its nature of processing external data:
- Ingestion points: Content retrieved from Monday.com boards and items through tools like
MONDAY_LIST_BOARD_ITEMS,MONDAY_ITEMS_PAGE, andMONDAY_LIST_SUBITEMS_BY_PARENT. - Boundary markers: No specific delimiters or instructions to ignore embedded commands are included for the processed data.
- Capability inventory: The skill has broad capabilities to write data, create updates, and execute GraphQL mutations on the connected account.
- Sanitization: There are no explicit sanitization or validation mechanisms described for handling external input before it influences agent behavior.
Audit Metadata