by 安全扫描
OpenClaw
安全
medium confidenceThe skill's requirements and runtime instructions match its stated purpose (a Monday.com integration proxied through Maton); nothing in the bundle is disproportionate, but the skill relies on a third‑party gateway (maton) of unknown provenance so you should vet that service before trusting credentials.
评估建议
This skill appears internally consistent: it uses a Maton API gateway to interact with Monday.com and only needs MATON_API_KEY. Before installing, verify you trust the Maton service (maton.ai / gateway.maton.ai / ctrl.maton.ai), confirm what permissions the MATON_API_KEY has, store the key securely, and prefer least privilege (rotate/revoke keys when done). If you prefer not to route tokens through a third party, consider using direct Monday.com OAuth/API credentials instead. If you need higher ...详细分析 ▾
✓ 用途与能力
The skill is a Monday.com GraphQL integration and only requests a MATON_API_KEY to call Maton's gateway (gateway.maton.ai / ctrl.maton.ai). Requiring a Maton API key is coherent with the described gateway‑proxy design.
✓ 指令范围
SKILL.md contains only network requests to Maton endpoints and examples that read MATON_API_KEY from the environment. It does not instruct reading unrelated files, system credentials, or exfiltrating data to unexpected endpoints.
✓ 安装机制
No install spec or code files are present; this is instruction‑only, so nothing is downloaded or written to disk by the skill itself.
ℹ 凭证需求
Only one env var (MATON_API_KEY) is required, which is proportional to a gateway‑based integration. Note: that key grants the Maton service the ability to act on your behalf (including managing OAuth connections to Monday.com), so its trustworthiness and scope/permissions matter.
✓ 持久化与权限
always is false and the skill does not request persistent system modifications or other skills' credentials. The skill can be invoked autonomously (platform default), which is expected for skills.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.32026/2/6
- Added new metadata fields under the "metadata" section, including a "clawdbot" section with emoji and required environment variable information. - No other changes to the skill implementation or usage instructions.
● 无害
安装命令
点击复制官方npx clawhub@latest install monday
镜像加速npx clawhub@latest install monday --registry https://cn.longxiaskill.com