ClawHub
Back to skill

Security audit

Plane CLI

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Plane.so CLI helper, with disclosed credential use and user-directed project-management actions.

Before installing, verify the plane-cli package source and consider pinning a reviewed version. Use a least-privilege Plane API key and review any stdin content, such as git diffs, before posting it to Plane comments.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:20
Finding

Unpinned Third-Party CLI Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 20
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code

bash
uv tool install plane-cli   # or: pip install plane-cli

Technical Analysis

The setup instructions install plane-cli from a third-party package registry without pinning a reviewed version or verifying package integrity. Consequently, the code installed and executed can change after this skill has been audited.

This creates a software supply-chain risk. If the package, its publishing account, the registry delivery path, or a transitive dependency is compromised, following the documented setup command could install attacker-controlled code. Package installation may execute build or installation hooks, and subsequent CLI invocation executes the installed package directly.

The CLI is expected to access PLANE_API_KEY, PLANE_WORKSPACE_SLUG, and potentially other Plane configuration. A compromised release could access those values with the privileges of the invoking user.

Attack Path

  1. An attacker compromises the plane-cli distribution, a maintainer account, or one of its dependencies.
  2. The attacker publishes a malicious release under the package name resolved by uv or pip.
  3. A user follows the unpinned installation command in SKILL.md.
  4. The package manager resolves and installs the malicious release.
  5. Malicious code executes during installation or when the plane command is invoked.
  6. The code may read Plane credentials and local data accessible to the user, exfiltrate them, or issue unauthorized Plane API operations.

Impact Assessment

Successful exploitation permits code execution with the local privileges of the user running the installation or CLI. The affected scope may include:

  • Exposure of PLANE_API_KEY and Plane configuration.
  • Unauthorized access to Plane workspaces and projects within the API key's permissions.
  • Creation, modi ...[truncated 499 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin plane-cli to a specifically reviewed version rather than resolving the latest release:

    bash
    uv tool install "plane-cli==<reviewed-version>"
# or
pip install "plane-cli==<reviewed-version>"

  2. Verify package integrity with trusted hashes or a locked dependency manifest where supported.

  3. Document the authoritative package registry, publisher, and source repository so users can detect dependency-confusion or typosquatting risks.

  4. Review and lock transitive dependencies, not only the top-level package.

  5. Install the CLI in an isolated virtual environment or container under an unprivileged account.

  6. Scope the Plane API key to the minimum permissions required, rotate it periodically, and revoke it immediately if package compromise is suspected.

  7. Avoid exposing unrelated secrets in the installation or execution environment. Review repository diffs and other stdin content for credentials before sending them to Plane.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.