project-lifecycle

No strong evidence of intentional malware in this Bash module. The main risk is configuration-integrity: ~/.claude/plane-workspaces.json controls both the API destination (base_url) and which environment variable is read as the API key (api_key_env). If that file is tampered with, the script can transmit an API key to an attacker-controlled HTTPS endpoint. Otherwise, the behavior is consistent with legitimate workspace detection and API lookup.