Plane.so

PassAudited by ClawScan on May 10, 2026.

Overview

This is a straightforward Plane.so CLI helper, but it relies on a downloaded executable and an API key that can read and change workspace data.

Before installing, verify the GitHub-hosted CLI script and consider using a limited Plane API token. Treat commands that create, update, assign, comment on, or delete Plane items as real workspace changes and confirm IDs before running them.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

If the downloaded CLI changes upstream or is compromised, it would run locally and use the user's Plane credentials.

Why it was flagged

The skill asks the user to install an executable script from a moving GitHub raw URL; the actual script was not included in the reviewed artifacts, so its contents and provenance cannot be verified here.

Skill content

curl -o ~/.local/bin/plane https://raw.githubusercontent.com/JinkoLLC/plane-skill/main/scripts/plane
chmod +x ~/.local/bin/plane

Recommendation

Review the script before installing, prefer a pinned release or checksum if available, and only install from a trusted source.

Note

ASI03: Identity and Privilege Abuse

What this means

The CLI can act as the authenticated Plane user within the configured workspace, depending on the token's permissions.

Why it was flagged

The integration uses a Plane personal access token and workspace slug, which is expected for Plane access but grants account/workspace authority to the CLI.

Skill content

export PLANE_API_KEY="your-api-key"
export PLANE_WORKSPACE="your-workspace-slug"

Recommendation

Use the least-privileged token available, avoid sharing the token, and revoke it if the CLI or machine is no longer trusted.

Note

ASI02: Tool Misuse and Exploitation

What this means

Mistaken or overly broad commands could change or remove project work items.

Why it was flagged

The documented CLI operations can modify assignments, update issue state/priority, and delete issues in Plane. This matches the stated project-management purpose, but these are high-impact workspace actions.

Skill content

plane issues update -p PROJECT_ID ISSUE_ID --state STATE_ID --priority medium
plane issues assign -p PROJECT_ID ISSUE_ID USER_ID_1 USER_ID_2
plane issues delete -p PROJECT_ID ISSUE_ID

Recommendation

Confirm project IDs, issue IDs, and destructive actions before running mutation commands, especially deletes or assignment changes.