My Plane

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:30 AM UTC
• Version: 1.0.2

Overview

This skill is for a real Plane.so workflow, but it asks users to install an unverified remote executable and gives broad workspace-changing commands, including deletion, without enough safety guidance.

Review the upstream CLI before installing, prefer a pinned release with checksum or signature verification, and use a least-privilege Plane token. Require explicit confirmation before running delete or broad mutation commands in a production workspace.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:14

Finding

Unverified Remote Executable Retrieved from a Mutable Release URL

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–15
Vulnerability Type: Remote payload retrieval and execution without integrity verification
Risk Level: High

bash

curl -L -o ~/.local/bin/plane https://github.com/HonLuk/my-plane/releases/latest/download/plane
chmod +x ~/.local/bin/plane

Technical Analysis

The installation instructions retrieve a precompiled executable through a mutable releases/latest URL and immediately make it executable. The artifact is not pinned to a reviewed version or immutable digest, and no checksum or cryptographic signature is verified.

Consequently, the effective executable can change after the skill has been reviewed. If the upstream repository, release process, maintainer account, or distributed artifact is compromised, the same documented command could install attacker-controlled code. The CLI is subsequently expected to run in an environment containing PLANE_API_KEY and PLANE_WORKSPACE, increasing the sensitivity of a supply-chain compromise.

The use of HTTPS protects transport in ordinary circumstances but does not establish that the downloaded artifact is the specific binary reviewed or intended by the user.

Attack Path

1. An attacker compromises the upstream GitHub repository, maintainer account, release workflow, or latest release artifact.
2. The attacker publishes a modified executable at the existing mutable releases/latest/download/plane location.
3. A user follows the documented installation procedure.
4. curl -L downloads the attacker-controlled file to ~/.local/bin/plane.
5. chmod +x marks the payload as executable.
6. When the user or agent invokes plane, the payload executes with the invoking user's operating-system privileges.
7. Because the CLI requires Plane environment credentials, the payload may read PLANE_API_KEY and use it to access or alter resources authorized to that token.

Impact Assessment

Succ ...[truncated 636 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin installation instructions to a specific reviewed release version rather than using releases/latest.
2. Publish a SHA-256 or stronger cryptographic digest through a separately protected release process and verify it before making the file executable.
3. Prefer signed releases, such as Sigstore or GPG signatures, and document mandatory signature verification with a pinned trusted identity or public key.
4. Fail closed: do not execute or install the artifact if digest or signature verification fails.
5. Provide auditable source code, reproducible build instructions, and provenance attestations so users can verify that the binary corresponds to reviewed source.
6. Run the CLI with a least-privilege Plane token and limit the token to only the workspace permissions required for the intended task.
7. Avoid exposing the API key to installation steps, and execute the CLI in a restricted environment where practical.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

export PLANE_BASE_URL="https://api.plane.so"

text

Get your API key from: **Plane → Profile Settings → Personal Access Tokens**

The workspace slug is the URL path segment (e.g., for `https://app.plane.so/my-team/` the slug is `my-team`).

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly documents a destructive plane issues delete command without any warning about permanence, confirmation expectations, or guidance to verify the target issue/project first. In an agent skill context, this increases the chance of accidental or overly broad deletion of production work items when the agent follows documentation literally.

Content

No source excerpt is available for this finding.