Plane.so CLI

Manage Plane.so projects and work items using a zero-dependency Python CLI. List projects, create/update/assign issues, add comments, search workspace. The p...

Security Scan

The skill's claimed behavior (a bundled Python CLI) aligns with the requested credentials, but its SKILL.md asserts a bundled executable while the package contains no code or install steps — that mismatch makes the skill incoherent and worth investigating before use.

Purpose & Capability

The requested binaries (python3) and environment variables (PLANE_API_KEY, PLANE_WORKSPACE) match the described Plane.so CLI purpose. However, the SKILL.md repeatedly states that a bundled executable exists in scripts/plane-so-cli, yet the registry package contains no code files or install spec — this inconsistency undermines the claimed capability.

Instruction Scope

The runtime instructions are narrowly scoped to talk to https://api.plane.so and only require the Plane API key and workspace. They do not instruct reading unrelated files or exfiltrating data. But because there is no bundled script or code to inspect, you cannot verify that the binary actually limits requests to the hardcoded host or that it doesn't access other data; the instructions alone are insufficient to prove behavior.

Install Mechanism

There is no install spec and no code files in the package, yet SKILL.md claims a bundled 'scripts/plane-so-cli' binary available on PATH after installation. That is an explicit inconsistency: either the skill is relying on a preinstalled system binary (not documented) or the claimed bundled executable is missing. Both possibilities are problematic and should be clarified.

Credentials

Requiring PLANE_API_KEY (primary credential) and PLANE_WORKSPACE is proportional and expected for a Plane.so CLI. No other secrets, unrelated credentials, or config paths are requested.

Persistence & Privilege

The skill does not request permanent/always-on inclusion and uses normal autonomous-invocation defaults. It does not ask to modify other skills or system-wide settings.

What to consider before installing

Before installing or enabling this skill: 1) Verify the upstream repository (https://github.com/luiseduardoaugusto/plane-so-cli) and confirm the claimed scripts/plane-so-cli actually exist and match the SKILL.md. 2) If the package is instruction-only, ask where the binary is expected to come from (preinstalled on host, platform-provided, or missing). 3) Only provide a Plane personal access token with the minimum scope needed (or use a short-lived/limited token) until you can inspect the code. 4) If you cannot review the CLI source, avoid exposing a production API key; test on a non-critical workspace. 5) If you proceed, monitor network requests and use the official Plane domain; if the binary is present, review it to confirm it hardcodes api.plane.so as claimed and does not send data elsewhere.

Plane.so CLI Skill

Interact with Plane.so project management via a clean, auditable Python CLI.

Zero dependencies — uses only Python 3.8+ stdlib. The plane-so-cli executable is bundled in scripts/plane-so-cli and available on PATH after installation.

Setup

Set these environment variables:

export PLANE_API_KEY="your-api-key"
export PLANE_WORKSPACE="your-workspace-slug"

Get your API key: Plane > Profile Settings > Personal Access Tokens

Commands

User & Workspace

plane-so-cli me                        # Show current user
plane-so-cli projects list             # List all active projects
plane-so-cli members                   # List workspace members

Issues (Work Items)

plane-so-cli issues list -p PROJECT_ID
plane-so-cli issues list -p PROJECT_ID --state STATE_ID
plane-so-cli issues list -p PROJECT_ID --priority high
plane-so-cli issues list -p PROJECT_ID --assignee USER_ID
plane-so-cli issues get -p PROJECT_ID ISSUE_ID
plane-so-cli issues create -p PROJECT_ID --name "Fix bug" --priority high
plane-so-cli issues create -p PROJECT_ID --name "Task" --assignee USER_ID
plane-so-cli issues update -p PROJECT_ID ISSUE_ID --state STATE_ID
plane-so-cli issues update -p PROJECT_ID ISSUE_ID --priority medium
plane-so-cli issues assign -p PROJECT_ID ISSUE_ID USER_ID_1 USER_ID_2
plane-so-cli issues delete -p PROJECT_ID ISSUE_ID
plane-so-cli issues search "login bug"
plane-so-cli issues my

Comments, States & Labels

plane-so-cli comments list -p PROJECT_ID -i ISSUE_ID
plane-so-cli comments add -p PROJECT_ID -i ISSUE_ID "Comment text"
plane-so-cli states -p PROJECT_ID
plane-so-cli labels -p PROJECT_ID

Cycles & Modules

plane-so-cli cycles list -p PROJECT_ID
plane-so-cli cycles get -p PROJECT_ID CYCLE_ID
plane-so-cli modules list -p PROJECT_ID
plane-so-cli modules get -p PROJECT_ID MODULE_ID

Output Formats

Default is human-readable table. Use -f json for raw JSON:

plane-so-cli projects list -f json

Typical Workflow

1. plane-so-cli projects list — find project ID
2. plane-so-cli members — find member IDs for assignment
3. plane-so-cli states -p PROJECT_ID — see available states
4. plane-so-cli issues create -p PROJECT_ID --name "Task" --assignee USER_ID
5. plane-so-cli comments add -p PROJECT_ID -i ISSUE_ID "Started working"

Security & Privacy

This skill communicates only with the Plane.so API. The API host is hardcoded to api.plane.so and cannot be overridden.

Endpoint	Data sent	Purpose
https://api.plane.so/api/v1/*	API key (header), project/issue data (body)	All Plane.so operations

• Your PLANE_API_KEY is sent as an X-API-Key header exclusively to https://api.plane.so
• The API host is hardcoded — no environment variable can redirect requests to another domain
• No data is cached, logged, or stored locally
• No telemetry or analytics are collected
• The full source code is auditable at github.com/luiseduardoaugusto/plane-so-cli and bundled in scripts/plane-so-cli