Plane.so

Manage Plane.so projects and work items using the `plane` CLI. List projects, create/update/search issues, manage cycles and modules, add comments, and assign members.

This skill appears to do what it says (manage Plane.so via the plane CLI), but take these precautions before installing: 1) Confirm the publisher/repo (https://github.com/JinkoLLC/plane-skill) is trustworthy and review the script at the raw URL — downloading and executing it will run arbitrary code on your machine. 2) Prefer an official release or package for the plane CLI if one exists instead of a raw script. 3) Provide PLANE_API_KEY with the minimum necessary permissions and keep it secret. 4) Ask the publisher to fix the registry metadata mismatch (it should declare the required binary and env vars) so the package manifest is consistent. 5) If you must install, inspect the downloaded file contents and consider running it in a safe environment first (e.g., container or VM).

Type: OpenClaw Skill Name: plane Version: 1.0.0 The skill is classified as suspicious due to its installation method, which involves downloading and executing an external script (`plane`) from a raw GitHub URL (`https://raw.githubusercontent.com/JinkoLLC/plane-skill/main/scripts/plane`) via `curl` and `chmod +x` as specified in `SKILL.md`. This introduces a supply chain risk, as the content of the downloaded script is not part of the skill bundle and could be altered remotely without a version change, potentially leading to arbitrary code execution. While the provided files do not contain explicit malicious intent or prompt injection attempts, this remote execution capability is a significant security risk.