Plane Project Manager

What to check before installing: - Metadata mismatch: confirm which metadata is authoritative — the registry summary or the included _meta.json/SKILL.md. The skill clearly expects ~/.config/plane/credentials.json; if the registry UI doesn't show that requirement, ask the publisher to fix it. - Do NOT reuse real/high-privilege credentials shown in examples. The SKILL.md contains an example email and plaintext password — treat those as accidental/example values and do not paste them into a production account. - Prefer API tokens over plaintext passwords: follow the doc's recommendation to generate a token and remove plaintext passwords from the credentials file. Use a low-permission account or scoped token for agent access. - Run in an isolated environment: because the skill reads a credentials file and talks to an HTTP endpoint, test it in a sandbox or VM with a local Plane instance and a dedicated account before granting access to real systems. - Validate endpoints: the docs use localhost and a specific port (mostly 8888). Ensure the skill will only call your intended Plane instance and not network endpoints you don't control. - Ask the maintainer to: (1) remove embedded example secrets from docs, (2) fix inconsistent metadata (requiredConfigPaths/primaryCredential), and (3) remove port inconsistencies and fragile cookie-parsing examples or replace them with robust token-based flows. Given the above, the package is not obviously malicious, but the metadata inconsistencies and poor-secret-handling practices justify manual review and remediation before use.