pp-plane

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The GitHub URL is a direct download of a pre-built executable from a personal repository (high-risk unless the repo, release, and binary checksums/signatures are verified); the api.plane.so host itself is an API endpoint and not a download source.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's installation steps fetch and install remote executables (curl download of the CLI: https://github.com/mvanhorn/printing-press-library/releases/download/plane-current/plane-pp-cli-linux-amd64 and Go module installs github.com/mvanhorn/printing-press-library/...@latest) which would execute remote code and are required if the CLI is not already present.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs installing a binary into /usr/local/bin using sudo and tells macOS users to clear Gatekeeper quarantine, which directs the agent to perform privileged system modifications and bypass OS security controls.