The Agent Skills Directory

[Command Execution] (SAFE): The skill uses bash -c and curl to perform API operations. While executing shell commands carries inherent risks, the examples provided demonstrate safe usage for the skill's intended purpose.
[Data Exposure & Exfiltration] (SAFE): The skill targets the official Monday.com API endpoint (api.monday.com). Authentication is handled via the MONDAY_API_KEY environment variable, avoiding hardcoded secrets and following best practices for credential management.
[Indirect Prompt Injection] (SAFE): The skill manages user-provided inputs (such as board IDs and item names) by writing them to a temporary JSON file (/tmp/monday_request.json) before transmission via curl.
Ingestion points: User-provided strings for board IDs, item IDs, and item names.
Boundary markers: None explicitly defined in the prompt templates.
Capability inventory: Local curl execution via bash -c.
Sanitization: The pattern of writing input to a file and using the @ flag in curl prevents direct shell command injection from malicious payload content.
[Metadata Poisoning] (SAFE): Skill metadata (name, description, secrets) is accurate and reflects the code's actual functionality without deceptive instructions.

monday