Nova Accountability

Manage accountability items on a Monday.com board. Use when creating new accountability items, checking on existing ones, running work sessions, or when a cr...

Before installing, confirm and correct the missing declarations and limit runtime scope: 1) Expect to provide a Monday API token (MONDAY_API_TOKEN) and board id (MONDAY_BOARD_ID) — the manifest should list them; 2) Ensure curl and jq are available or update the script to avoid jq; 3) Note the script will look in ~/.openclaw/.env for MONDAY_API_TOKEN — review that file for other secrets and consider placing the token in a dedicated env var instead; 4) Decide whether you want the agent to be allowed to 'spawn sub-agents' and 'message anyone' — if not, restrict the agent's permissions or remove/modify those instructions; 5) Run the skill in a constrained environment (limited network access, least-privilege token scoped to boards read/write) and review logs for outbound communication; and 6) If you need high assurance, ask the publisher to update the skill metadata to declare required env vars and binaries and to clarify exactly which external channels (email, Slack, etc.) the agent will use and what credentials are needed.

Type: OpenClaw Skill Name: nova-accountability Version: 2.0.0 The skill contains shell injection vulnerabilities in `scripts/monday-api.sh` due to unsafe handling of arguments in the `query` function and `update` command. Additionally, the `SKILL.md` instructions contain high-risk directives for an autonomous agent, such as 'Don't limit yourself' when messaging people and spawning sub-agents, which could lead to unauthorized communications or resource exhaustion. While the behavior aligns with the stated purpose of a proactive 'Accountability' manager, the combination of insecure scripting and broad operational autonomy warrants a suspicious classification.