ClawHub
Back to skill

Security audit

My Plane

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Plane.so CLI helper, but users should treat its API key and delete/update commands carefully because they affect live workspace data.

Install only if you trust the GitHub release that provides the plane CLI and want an agent to operate on your Plane workspace. Store PLANE_API_KEY as a secret, verify PLANE_WORKSPACE and PLANE_BASE_URL before use, and require explicit confirmation before create, update, assign, comment, or delete actions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill metadata and description describe general project and work-item management, but the documented commands also include permanent issue deletion. Omitting destructive capability from the manifest can mislead users or higher-level agents about the tool's risk profile, increasing the chance of unintended destructive actions.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill exposes a destructive delete command with no warning, confirmation guidance, or cautionary language. In an agent context, this increases the risk that a user or automation invokes deletion casually or by misunderstanding, causing irreversible loss of project data.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.