← Back to Skills Marketplace
379
Downloads
0
Stars
0
Active Installs
2
Versions
Install in OpenClaw
/install monday-com
Description
Manage monday.com boards, items, columns, groups, updates, and workflows via MCP server (preferred) and GraphQL API (fallback). Use when a user asks to creat...
Usage Guidance
This skill appears coherent for a monday.com integration, but take these precautions before installing:
- Prefer the GraphQL fallback unless you trust the MCP package source; invoking `npx ...@latest` downloads and runs remote code each time — consider pinning a specific version instead of `@latest`.
- Store MONDAY_API_TOKEN in a secrets manager or platform secret (not plaintext). Limit the token's scope if possible and use temporary/rotated tokens.
- Review the MCP package repository (if you plan to use it) so you trust its publisher and release history.
- Monitor token usage and audit monday.com activity after enabling the skill. If you cannot confirm the MCP package source, avoid running subprocess installs and stick to direct GraphQL calls.
Capability Analysis
Type: OpenClaw Skill
Name: monday-com
Version: 1.3.0
The skill bundle contains highly unusual instructions in `SKILL.md` for bypassing an 'agent-verification challenge' called 'Hatcha' using various decoding techniques (ROT13, Base64, Hex), which suggests a mechanism for unauthorized autonomous account creation. Furthermore, it directs the agent to install an MCP server from `@mondaydotcomorg/monday-api-mcp`, a package name that appears to be a typosquatted version of the official monday.com developer namespace, posing a high risk of supply chain attack via `npx` execution. While no direct data exfiltration is observed, the combination of security bypass instructions and suspicious package dependencies warrants a cautious classification.
Capability Assessment
Purpose & Capability
Name/description match the requested env var (MONDAY_API_TOKEN) and the SKILL.md explains using monday's MCP server or GraphQL API to manage boards/items/columns/etc., which is expected for this integration.
Instruction Scope
The instructions stay on-topic (signup, obtain token, use MCP or GraphQL, example queries/mutations). They don't ask to read unrelated system files or other credentials. They do instruct running an MCP subprocess or using npx, which broadens what the agent will execute at runtime (see install_mechanism).
Install Mechanism
There is no formal install spec (instruction-only), but SKILL.md recommends invoking the official MCP server via `npx -y @mondaydotcomorg/monday-api-mcp@latest`. Relying on npx/@latest downloads and executing third-party code at runtime is a supply-chain risk; however, this is optional and the doc encourages falling back to direct GraphQL calls.
Credentials
Only MONDAY_API_TOKEN is required and it is justified by the skill's purpose. No unrelated secrets, config paths, or multiple credential requests are present.
Persistence & Privilege
Skill is instruction-only, no install, not always-enabled, and does not request system-wide changes or other skills' configs. Autonomous invocation is allowed by default but not combined with other high-risk factors here.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install monday-com - After installation, invoke the skill by name or use
/monday-com - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.3.0
Remove curl examples with auth headers from SKILL.md to avoid VirusTotal false positive. GraphQL examples moved to references/graphql-examples.md. No functional changes.
v1.2.0
monday.com skill: boards, items, columns, groups, updates, workflows, MCP + GraphQL API
Metadata
Frequently Asked Questions
What is monday.com?
Manage monday.com boards, items, columns, groups, updates, and workflows via MCP server (preferred) and GraphQL API (fallback). Use when a user asks to creat... It is an AI Agent Skill for Claude Code / OpenClaw, with 379 downloads so far.
How do I install monday.com?
Run "/install monday-com" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is monday.com free?
Yes, monday.com is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does monday.com support?
monday.com is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created monday.com?
It is built and maintained by regevguym (@regevguym); the current version is v1.3.0.
More Skills