Planka

Manage Planka (Kanban) projects, boards, lists, cards, and notifications via a custom Python CLI.

This skill appears to be what it claims, but take these precautions before installing or using it: 1) Verify the planka-cli source code or repository before installing—prefer installing from a vetted source (pipx from PyPI or an official GitHub release) rather than an unknown Homebrew tap. 2) Avoid passing plain passwords on the command line (use interactive prompts, environment variables, or token-based auth if supported). 3) Check where planka-cli stores credentials and whether it encrypts them (inspect config files and their filesystem permissions). 4) Ensure you use HTTPS endpoints for your Planka instance. 5) If you are unsure about trust, install and run the CLI inside an isolated environment (VM or container) and audit network activity while using it.

Type: OpenClaw Skill Name: planka Version: 0.1.12 The skill is suspicious due to a significant supply chain risk. It instructs the agent to install a binary (`planka-cli`) from an arbitrary, unverified third-party Homebrew tap (`brew tap voydz/homebrew-tap`) in `SKILL.md`. This delegates trust to an external entity, allowing for potential future compromise or the installation of a pre-existing malicious payload, which could lead to unauthorized execution or data exfiltration without direct evidence in the provided files.