ClawHub
Back to skill

Security audit

Planka

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Planka CLI helper, but it tells users to pass passwords on the command line and relies on an unpinned third-party executable install.

Review this before installing. Prefer a safer login flow that prompts for the password or uses a protected credential mechanism, verify the Homebrew tap and planka-cli source before installation, and use an account with only the Planka permissions needed because the CLI can read and change Planka data.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned Executable Installation from a Third-Party Homebrew Tap

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-17
Vulnerability Type: Unverified third-party dependency installation
Risk Level: Medium

bash
1.  **Install via Homebrew tap:**
    ```bash
    brew tap voydz/homebrew-tap
    brew install planka-cli
    ```

Technical Analysis

The installation instructions add a third-party Homebrew tap and install planka-cli without pinning an immutable release, commit, formula revision, or expected artifact checksum. The project contains no source code for the installed executable, so its behavior and integrity cannot be verified from the audited artifact.

Homebrew formulae may execute installation logic and install executable code. If the tap owner, repository, release infrastructure, or associated account is compromised, the formula or downloaded package could be replaced with attacker-controlled content. Users following the documented instructions would then execute code that was not present during this audit.

This is a supply-chain weakness rather than evidence that the named tap is currently malicious.

Attack Path

  1. An attacker compromises the third-party tap, its maintainer account, or its package distribution infrastructure.
  2. The attacker modifies the formula or referenced release artifact to install a trojanized planka-cli.
  3. A user follows the documented brew tap and brew install instructions.
  4. Homebrew retrieves and executes the modified installation logic or installs the malicious binary.
  5. The trojanized CLI runs with the invoking user's privileges when the user logs in or performs Planka operations.
  6. The malicious executable can access credentials supplied to it, Planka API data, and local files accessible to that user.

Impact Assessment

Successful exploitation could provide code execution with the privileges of the user running Homebrew or the installed CLI. The attacker could steal Planka credentials, ...[truncated 275 chars]

Remediation
View remediation

Remediation Suggestions

  • Prefer an official, reviewed distribution channel controlled by the Planka project or the skill publisher.
  • Pin the dependency to an immutable version and, where supported, an exact source commit.
  • Publish and verify cryptographic checksums or signatures for release artifacts.
  • Document the source repository and formula used to build the executable so users can audit it.
  • Use automated dependency monitoring and require review for formula or artifact changes.
  • Consider vendoring a reviewed implementation or providing reproducible build instructions.
  • Run the CLI with least privilege and avoid granting it access to unrelated credentials or sensitive local files.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:23
Finding

Planka Password Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23-26; repeated at line 38
Vulnerability Type: Plaintext credential exposure
Risk Level: Medium

bash
```bash
planka-cli login --url https://planka.example --username alice --password secret
# or: python3 scripts/planka_cli.py login --url https://planka.example --username alice --password secret
text

The same unsafe invocation pattern is repeated in the usage section:

```bash
planka-cli login --url https://planka.example --username alice --password secret

Technical Analysis

The documentation instructs users to supply a password directly through the --password command-line option. Command-line arguments are not an appropriate secret-transport mechanism because they may be recorded in shell history, terminal session logs, CI/CD logs, audit telemetry, or process metadata. Depending on the operating system and process-inspection permissions, another local process may also be able to observe the argument while the login command is running.

Although the example uses the placeholder value secret, users are likely to substitute a real password while following the command. The issue therefore creates a practical credential-disclosure risk.

The referenced scripts/planka_cli.py implementation is not included in the project, so the security of subsequent credential storage cannot be assessed.

Attack Path

  1. A user copies the documented command and replaces secret with a real Planka password.
  2. The shell records the complete command in its history, or a terminal, automation platform, or monitoring system captures it.
  3. Alternatively, an authorized local observer reads the process arguments while the command is running.
  4. An attacker or another local user gains access to that history, log, telemetry record, or process metadata.
  5. The attacker extracts the username, Planka URL, and plaintext password.
  6. The attacker authen ...[truncated 609 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove password values from command-line examples.
  • Make planka-cli login prompt interactively for the password using hidden, non-echoing input.
  • Support reading the password from standard input through an explicitly documented secure mode.
  • Store resulting credentials in the operating system's credential manager or keychain rather than a plaintext configuration file.
  • If environment-variable input is supported for automation, document its exposure risks and ensure logs redact the variable; protected standard input or a secrets-manager integration is preferable.
  • Ensure the CLI never logs passwords, authorization headers, session tokens, or complete login requests.
  • Add warnings advising users to remove any existing password-bearing commands from shell history and rotate credentials that may have been exposed.
  • Include the referenced implementation in the audited project or link to an immutable source revision so credential handling can be reviewed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly instructs users to pass a plaintext password on the command line during login. Command-line arguments are commonly exposed via shell history, process listings, terminal logs, and audit tooling, which can leak Planka credentials to other local users or to logging systems. In this context, the risk is real because the skill is operational guidance, not just illustrative API syntax, and it normalizes an unsafe authentication practice without warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The usage section includes planka-cli logout to remove stored credentials and planka-cli cards delete <CARD_ID> to delete a card, but the markdown does not disclose any consequences or whether these actions are reversible. For a skill description, destructive operations affecting user data should be accompanied by clear warnings.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.