Posthive

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:13 AM UTC
• Version: 0.1.0

Overview

This skill is a straightforward Posthive social-post scheduling helper, with a notable but disclosed dependency-installation caution.

Before installing, make sure you trust the Posthive CLI source and prefer a pinned or locked version instead of fetching the latest package at runtime. Expect it to use Posthive credentials and connected social accounts, and keep the draft-first workflow unless you intentionally want direct scheduling or deletion.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21

Finding

Unpinned npm Package Execution Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 21
Vulnerability Type: Unpinned third-party package installation and execution
Risk Level: Medium

Vulnerable Code

markdown

Run commands with `npx posthive-cli` or `posthive` if installed globally (`npm i -g posthive-cli`).

Technical Analysis

The skill instructs the agent to run posthive-cli through npx or install it globally without specifying a reviewed version. With no version pin, lockfile, integrity hash, signature check, or publisher verification, npm can resolve a mutable package release at execution time.

The npx posthive-cli form may download and immediately execute the resolved package. The global installation alternative can also execute npm installation lifecycle scripts and place package-controlled executables in the user's global command path. Consequently, later compromise of the package, its publisher account, or a transitive dependency could turn an otherwise legitimate skill invocation into arbitrary local code execution.

No evidence establishes that the current package is malicious. The vulnerability is the unsafe dependency acquisition and execution model.

Attack Path

1. An attacker compromises the posthive-cli package, its publisher account, or a transitive dependency and publishes a malicious release.
2. The agent follows the skill instructions and invokes npx posthive-cli or runs npm i -g posthive-cli.
3. npm resolves the unpinned malicious release.
4. Package code or an installation lifecycle script executes with the invoking user's permissions.
5. The payload accesses resources available to that user or modifies the globally installed command.
6. It may target the documented Posthive configuration at ~/.posthive/config.json, read POSTHIVE_API_KEY from the process environment, or use authenticated social-media operations to perform unauthorized actions.

Impact Assessment

Successful exploitation provides code execution with ...[truncated 466 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin posthive-cli to a specific reviewed version rather than resolving the latest release implicitly.
2. Install the dependency locally using a committed lockfile with npm integrity metadata.
3. Prefer invoking the audited local executable instead of using ad hoc npx downloads or global installation.
4. Verify and document the package's official npm scope, publisher, repository, and expected release provenance.
5. Validate package integrity through registry integrity hashes or signed provenance before execution.
6. Disable npm lifecycle scripts during installation where compatible, then explicitly execute only reviewed setup operations.
7. Run the CLI with least privilege and expose only the credentials required for the requested operation.
8. Protect ~/.posthive/config.json with restrictive filesystem permissions and avoid unnecessarily propagating POSTHIVE_API_KEY to child processes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs use of npx posthive-cli without pinning a specific package version. This causes the agent or user to fetch and execute whatever version is current at runtime, creating a supply-chain risk if a malicious or compromised release is published or if behavior changes unexpectedly. In this skill context, the risk is heightened because the CLI handles authentication and social-media posting, so a bad package version could access stored credentials or publish unauthorized content.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description says the skill schedules posts to 13 platforms and lists 11 named examples ending with Nostr, but the file's platform notes and commands also document Discord and Tumblr support. This creates a semantic mismatch between the advertised scope and the actual documented capability.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The workflow section instructs agents to always begin with accounts:list, while the setup section says to run posthive whoami first if unsure whether the user is logged in. These instructions are in tension because an unauthenticated accounts:list may fail, contradicting the claimed mandatory first step.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.