planka — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited planka (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Interact with a self-hosted Planka instance. Planka is a Trello-like kanban board.
See README.md for setup instructions, usage examples, and advanced use cases.
Required environment variables:
PLANKA_URL — Base URL (e.g. https://planka.example.com)PLANKA_API_KEY — API key (generated in Planka UI → User Settings)These can be set in:
.env file (most common)~/.env (global, for cross-project use)~/.bashrc or ~/.zshrc)Base path: $PLANKA_URL/api/
Auth header: X-Api-Key: $PLANKA_API_KEY
Full OpenAPI spec: https://plankanban.github.io/planka/swagger-ui/swagger.json
/card-labels instead of /cards/{cardId}/card-labels). curl -sL https://plankanban.github.io/planka/swagger-ui/swagger.json | python3 -c "
import json, sys
spec = json.load(sys.stdin)
for path, methods in spec.get('paths', {}).items():
for method in methods:
if method in ('get','post','put','patch','delete'):
print(f'{method.upper()} {path}')
" | grep -i "SEARCH_TERM"/cards/{id}/card-labels vs /card-labels).{"item": {...}} for single, {"items": [...]} for collections, related data in "included"dark-granite, lagoon-blue, orange-peel, bright-moss, berry-red, light-mud, midnight-blue, light-cocoa, summer-sky, pumpkin-orangeThe user can talk naturally or use optional shorthand commands:
| Command | Description |
|---|---|
/planka overview | Show all projects and boards |
/planka board <name> | Show a specific board with lists and cards |
These are shortcuts — the user can also just describe what they want freely: "create a card for Feature X", "move Bug Y to Done", "set up a new board with labels", etc.
Understand the intent, look up the right endpoints from the OpenAPI spec if needed, and execute.
Finding boards: Never hardcode IDs. Always list projects first, find boards from the included data, and match by name.
Null safety: Many Planka fields can be None/null — name, description, color, position, etc. Always use or "", or 0, (x or "").strip() patterns in Python code. Never call methods on potentially null values without guarding.
Display formatting:
overview: Show projects as headers with boards as bullet points. Include board card count.board <name>: Show each list as a section with its cards listed below. For each card show: name, labels (as colored badges), task progress (e.g. 3/5), and description preview if available. Use markdown formatting — headers for lists, bullet points for cards. Skip empty/unnamed system lists (archive, trash).Always:
source .env 2>/dev/null; source ~/.env 2>/dev/null — tries project .env first, then global ~/.env, silently skips if missingcurl -sL (silent + follow redirects)python3 -c "import json; ..." for safe JSON encoding~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.