Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mondaycom/mcp --skill data-cleanupgit clone --depth 1 https://github.com/mondaycom/mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mondaycom/mcp/data-cleanup)<a href="https://agentmods.dev/skills/mondaycom/mcp/data-cleanup"><img src="https://agentmods.dev/badge/skills/mondaycom/mcp/data-cleanup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mondaycom/mcp/data-cleanup"><img src="https://agentmods.dev/badge/skills/mondaycom/mcp/data-cleanup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 23 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Rogue Agent · line 25 Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
- high Prompt Injection · line 215 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00131 | $0.05584 |
| Opus 5.5 | $0.00052 | $0.02234 |
| Sonnet 5.5 | $0.00026 | $0.01117 |
| Haiku 4.5 | $0.00013 | $0.00558 |
Grade A, and why
data-cleanup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 357 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Data Cleanup
Two jobs in one skill for the recurring "my CRM is messy" pain (Sidekick's #1 negative-sentiment JTBD):
- Health check (report-only): a scored structural audit of a CRM board — missing-data patterns, stalled groups, abandoned columns, automation gaps, and a 0–100 data-quality score — published as a diagnosis doc. No writes.
- Cleanup (fix): audit the board for data gaps, let the user pick which to fix, then run a bounded, idempotent write loop.
Flow (report): Trigger → Gather → Score (5 strands) → Publish diagnosis doc → offer to fix. Flow (fix): Trigger → Audit → User picks gaps → Plan writes → Execute (bounded, idempotent) → Summary.
Input
- Optional: board name/ID via argument.
- Optional: pre-declared mode (Default / Silent / Proactive).
Output
- α (default): Bounded write loop on the chosen board. Normalizes phone/country/email; can also batch-set owner / source / last-touch / stage when the user explicitly picks those gap types and signals are clean. A
Hygiene fix — <Mon DD>doc lists every change withGenerated by Claudefooter +<!-- claude-skill-id: data-cleanup -->. - β (opt-in): A "before/after" snapshot doc (preserves the prior state for ~30 days, in case a pass over-corrected). User is asked at Step 4.
- Proactive extension: Out of scope — data-cleanup is already a write skill; proactive doesn't change its behavior. Default mode + batched confirm is the only write surface.
Knowledge
- Gap taxonomy + audit rules (§ Step 3).
- Normalization recipes (§ Step 5).
- Shared artifact conventions (§ Shared patterns).
Tools (MCP)
get_user_context,list_workspaces,search,get_board_info,get_column_type_info,get_board_items_page,board_insights— Gather.list_users_and_teams— enumerate users for bulk-assign owner step.change_item_column_values— the core write. Loop with bounded concurrency.create_doc/create_update— publish summary + before/after snapshot.all_monday_api— escape hatch for column types not exposed bychange_item_column_values. Forcountrycolumns, use:change_multiple_column_valueswithcolumn_values: {"<country_col_id>": {"countryCode": "<ISO2>", "countryName": "<name>"}}. Do not freeform the mutation type — only this shape is supported for country columns.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 357 lines · 131 tokens per session scan A a839a0bba817
data-cleanup is a skill published in the GitHub repository mondaycom/mcp (433 stars, last pushed today), licensed MIT. It adds 131 tokens to every session and 5,584 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agents-sdk-dotnet
Use when any code imports Microsoft.Agents.Hosting.AspNetCore, Microsoft.Agents.Builder, or related Agents SDK packages, or when the user is building, configuring, or asking questions about a Microsoft 365 Agents SDK agent in C# / .NET. Trigger on questions about appsettings.json, connection configuration…
agents-sdk-dotnet-otel
Use when adding, configuring, validating, or troubleshooting OpenTelemetry observability for a Microsoft 365 Agents SDK application in C# / .NET. Trigger when the user mentions OpenTelemetry, OTel, telemetry, traces, metrics, logs, OTLP, Aspire Dashboard, Application Insights, Azure Monitor, distributed tracing…
bf-to-agents-sdk-dotnet-migration
Use when migrating a Bot Framework .NET SDK bot to Microsoft 365 Agents SDK. Triggered by projects that depend on packages: Microsoft.Bot.Builder or Microsoft.Bot.Builder.Integration.AspNet.Core that want to migrate to Agents SDK.
teams-app-manifest
Create or audit a Microsoft Teams app manifest for an existing Microsoft 365 Agents SDK application by mapping declared intent and source-code evidence to released manifest capabilities. Use when manifest.json is missing, incomplete, or must be checked against implemented Teams features. Does not configure Microsoft…
agents-sdk-dotnet-debugging
Use when troubleshooting an agent built with the Microsoft Agents SDK (Microsoft.Agents.Hosting.AspNetCore and related packages) in C# / .NET. Trigger on any of these symptoms: build or C# compile errors, crashes on startup, 401 or auth errors on incoming requests, the bot not responding to messages, appsettings.json…
github-review-pr
Review GitHub pull requests with detailed, multi-perspective code analysis using parallel subagents. Use this skill whenever the user wants to review a PR, asks for code review on a pull request, mentions "review PR", "check this PR", "look at pull request", or references a PR number or GitHub PR URL. Do NOT use for…