PostKing · Getting Started

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:59 AM UTC
• Version: 1.0.2

Overview

The skill is not visibly malicious, but it gives an agent broad PostKing account, billing, publishing, deletion, domain, and API-key guidance that exceeds a thin router's stated role.

Review before installing. Use a pinned, reviewed postking-cli version; avoid running the router with billing, API-key, domain, or destructive content permissions unless you intend those operations; require explicit confirmation before purchases, publishing, deletions, domain changes, uploads, social account changes, or key creation; and treat returned API keys as secrets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/install.md:5
• Finding: Unpinned Third-Party CLI Installation and Execution## Vulnerability Details **File Location**: `references/install.md`, lines 5–26 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```markdown ## Install Global install (preferred): ``` npm i -g postking-cli ``` ## Ephemeral invocation (no global install) If the global install fails with permission errors (common in sandboxed agent terminals), invoke via `npx` without installing: ``` npx -p postking-cli@latest pking --version ``` Use `npx -p postking-cli@latest pking <command>` for all subsequent calls when running ephemerally. ## Upgrade To upgrade to the latest version: ``` npm i -g postking-cli@latest ``` ``` ### Technical Analysis The installation instructions download and execute `postking-cli` without pinning an exact, audited version or verifying its integrity. Both the unversioned global installation and the explicit `@latest` commands allow the retrieved package contents to change after this Skill has been reviewed. npm package installation may execute package lifecycle scripts. The `npx` workflow also downloads and runs the selected package immediately. The implementation of `postking-cli` is not included in the audited project, so its code, transitive dependencies, and lifecycle behavior could not be verified during this audit. This is particularly sensitive because the documented CLI is subsequently trusted to perform authenticated operations, store local credentials, read user-selected files, upload assets, publish content, initiate billing workflows, and manage API keys. The finding does not establish that the current package is malicious; it identifies an avoidable supply-chain trust boundary. ### Attack Path 1. An attacker compromises the `postking-cli` npm package, a maintainer account, the package publication pipeline, or a transitive dependency. 2. The attacker publishes a malicious release that becomes the package vers ...[truncated 1495 chars]
• Remediation: ## Remediation Suggestions 1. Pin `postking-cli` to an exact reviewed version rather than using an unversioned package or `@latest`, for example: ```sh npm install --global postking-cli@1.0.3 npx --package=postking-cli@1.0.3 -- pking --version ``` 2. Publish and verify a cryptographic checksum, npm integrity value, signed release, or package provenance attestation before execution. 3. Audit the pinned package, its lifecycle scripts, and its complete transitive dependency tree. Repeat this review before changing the pinned version. 4. Prefer a project-local installation governed by a committed lockfile over a global installation. 5. Where compatible with the verified package, disable installation lifecycle scripts with `--ignore-scripts`; otherwise, explicitly audit every required lifecycle script. 6. Run the CLI as an unprivileged user in a restricted environment. Do not use `sudo` for global installation. 7. Limit filesystem visibility, environment variables, and PostKing API scopes to those required for the requested operation. 8. Require explicit user confirmation before file uploads, publishing, deletion, billing, API-key creation, or other consequential operations. 9. Consider vendoring the reviewed CLI implementation or linking installation instructions to a reproducible, signed release artifact.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The command reference exposes a very broad operational surface — auth, billing, domains, publishing, deletion, and API key management — despite the skill being described as a router that should only confirm brand and hand off to specialists. In an agent setting, documenting these capabilities materially increases the chance the router will invoke powerful commands directly, bypassing intended privilege separation and enabling destructive or financially impactful actions.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Billing and subscription purchase commands allow spending money and changing service plans, which is unnecessary for a handoff-only router. In an agent workflow, exposing these actions creates risk of unauthorized purchases, subscription changes, and social-engineering-driven financial abuse.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

pking voice brand delete <voiceProfileId> [--brand <id>] --destructive [--json]
                                           Delete a brand-owned voice profile. --destructive
                                           is required to confirm.
                                           Wraps DELETE /api/agent/v1/brands/{brandId}/voice-profiles/{voiceProfileId}.

Voice profile CREATION (extracting tone from X / LinkedIn / Threads / URLs)
runs through async extract endpoints and is currently web-only — direct

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: API key management is a high-privilege capability unrelated to a router's stated purpose. If the router can create or revoke keys, it could mint durable credentials, expand access outside the agent boundary, or disrupt integrations, making compromise of the router far more serious.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Authentication and registration flows are broader than needed for a router and can let the skill alter session state, create accounts, or steer users through credential-related actions. While these commands are normal for a CLI, they enlarge the attack surface and undermine the expectation that the router only identifies brand context and delegates onward.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Domain management allows adding, connecting, verifying, and deleting domains, which is operationally sensitive and unrelated to simple routing. Exposing this to a router increases the chance of accidental or unauthorized changes that can affect publication availability, SEO posture, or brand web presence.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation states that key creation returns the plaintext key once, but gives no warning to treat it as a secret, avoid echoing/logging it, or store it securely. In agent environments, secrets can easily be surfaced back to users, captured in logs, or propagated to other tools, resulting in credential leakage.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The documentation instructs users to run `npx -p postking-cli@latest`, which fetches and executes the latest package version at runtime rather than a reviewed, fixed version. This creates a supply-chain risk: if the package is compromised, unpublished/replaced, or a breaking/malicious release is published, users and agents may immediately execute attacker-controlled code.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The guidance to use `npx -p postking-cli@latest pking <command>` for subsequent calls means every ephemeral invocation may resolve and execute whatever code is currently published as the latest package. In an agent or sandboxed environment, this increases exposure because commands may be run non-interactively and repeatedly, amplifying the impact of a malicious or compromised upstream release.

Static analysis

No suspicious patterns detected.