PostKing · Getting Started

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:59 AM UTC
• Version: 1.0.2

Overview

The skill is not visibly malicious, but it gives an agent broad PostKing account, billing, publishing, deletion, domain, and API-key guidance that exceeds a thin router's stated role.

Review before installing. Use a pinned, reviewed postking-cli version; avoid running the router with billing, API-key, domain, or destructive content permissions unless you intend those operations; require explicit confirmation before purchases, publishing, deletions, domain changes, uploads, social account changes, or key creation; and treat returned API keys as secrets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/install.md:5

Finding

Unpinned Third-Party CLI Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: references/install.md, lines 5–26
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

markdown

## Install

Global install (preferred):

npm i -g postking-cli

text

## Ephemeral invocation (no global install)

If the global install fails with permission errors (common in sandboxed agent terminals), invoke via `npx` without installing:

npx -p postking-cli@latest pking --version

text

Use `npx -p postking-cli@latest pking <command>` for all subsequent calls when running ephemerally.

## Upgrade

To upgrade to the latest version:

npm i -g postking-cli@latest

text

Technical Analysis

The installation instructions download and execute postking-cli without pinning an exact, audited version or verifying its integrity. Both the unversioned global installation and the explicit @latest commands allow the retrieved package contents to change after this Skill has been reviewed.

npm package installation may execute package lifecycle scripts. The npx workflow also downloads and runs the selected package immediately. The implementation of postking-cli is not included in the audited project, so its code, transitive dependencies, and lifecycle behavior could not be verified during this audit.

This is particularly sensitive because the documented CLI is subsequently trusted to perform authenticated operations, store local credentials, read user-selected files, upload assets, publish content, initiate billing workflows, and manage API keys. The finding does not establish that the current package is malicious; it identifies an avoidable supply-chain trust boundary.

Attack Path

1. An attacker compromises the postking-cli npm package, a maintainer account, the package publication pipeline, or a transitive dependency.
2. The attacker publishes a malicious release that becomes the package vers ...[truncated 1495 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin postking-cli to an exact reviewed version rather than using an unversioned package or @latest, for example:

   sh

   npm install --global postking-cli@1.0.3
   npx --package=postking-cli@1.0.3 -- pking --version
   

2. Publish and verify a cryptographic checksum, npm integrity value, signed release, or package provenance attestation before execution.
3. Audit the pinned package, its lifecycle scripts, and its complete transitive dependency tree. Repeat this review before changing the pinned version.
4. Prefer a project-local installation governed by a committed lockfile over a global installation.
5. Where compatible with the verified package, disable installation lifecycle scripts with --ignore-scripts; otherwise, explicitly audit every required lifecycle script.
6. Run the CLI as an unprivileged user in a restricted environment. Do not use sudo for global installation.
7. Limit filesystem visibility, environment variables, and PostKing API scopes to those required for the requested operation.
8. Require explicit user confirmation before file uploads, publishing, deletion, billing, API-key creation, or other consequential operations.
9. Consider vendoring the reviewed CLI implementation or linking installation instructions to a reproducible, signed release artifact.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The command reference exposes a very broad operational surface — auth, billing, domains, publishing, deletion, and API key management — despite the skill being described as a router that should only confirm brand and hand off to specialists. In an agent setting, documenting these capabilities materially increases the chance the router will invoke powerful commands directly, bypassing intended privilege separation and enabling destructive or financially impactful actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Billing and subscription purchase commands allow spending money and changing service plans, which is unnecessary for a handoff-only router. In an agent workflow, exposing these actions creates risk of unauthorized purchases, subscription changes, and social-engineering-driven financial abuse.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/commands.md (reported line 293)May include surrounding context.

md

pking voice brand delete <voiceProfileId> [--brand <id>] --destructive [--json]
                                           Delete a brand-owned voice profile. --destructive
                                           is required to confirm.
                                           Wraps DELETE /api/agent/v1/brands/{brandId}/voice-profiles/{voiceProfileId}.

Voice profile CREATION (extracting tone from X / LinkedIn / Threads / URLs)
runs through async extract endpoints and is currently web-only — direct

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

API key management is a high-privilege capability unrelated to a router's stated purpose. If the router can create or revoke keys, it could mint durable credentials, expand access outside the agent boundary, or disrupt integrations, making compromise of the router far more serious.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Authentication and registration flows are broader than needed for a router and can let the skill alter session state, create accounts, or steer users through credential-related actions. While these commands are normal for a CLI, they enlarge the attack surface and undermine the expectation that the router only identifies brand context and delegates onward.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Domain management allows adding, connecting, verifying, and deleting domains, which is operationally sensitive and unrelated to simple routing. Exposing this to a router increases the chance of accidental or unauthorized changes that can affect publication availability, SEO posture, or brand web presence.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation states that key creation returns the plaintext key once, but gives no warning to treat it as a secret, avoid echoing/logging it, or store it securely. In agent environments, secrets can easily be surfaced back to users, captured in logs, or propagated to other tools, resulting in credential leakage.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The documentation instructs users to run npx -p postking-cli@latest, which fetches and executes the latest package version at runtime rather than a reviewed, fixed version. This creates a supply-chain risk: if the package is compromised, unpublished/replaced, or a breaking/malicious release is published, users and agents may immediately execute attacker-controlled code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The guidance to use npx -p postking-cli@latest pking <command> for subsequent calls means every ephemeral invocation may resolve and execute whatever code is currently published as the latest package. In an agent or sandboxed environment, this increases exposure because commands may be run non-interactively and repeatedly, amplifying the impact of a malicious or compromised upstream release.

Content

No source excerpt is available for this finding.