PosteAhora is a tool to schedule and publish social media posts to Instagram, TikTok, YouTube, X (Twitter), Facebook, LinkedIn, Threads, Bluesky and Discord — from your own code, terminal, CI, or an AI agent, via a CLI, an MCP server, or a REST API.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:09 AM UTC
• Version: 0.1.0

Overview

The skill is coherent for social media publishing, but it asks users to run an unpinned external CLI that will handle credentials and can publish publicly.

Review before installing. Pin and verify the @posteahora/cli version where possible, avoid unversioned npx for agent use, protect or rotate API keys, prefer drafts until a human confirms the exact channels and caption, and treat uploaded media URLs as public.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:23

Finding

Unpinned and Unverifiable Third-Party CLI Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:23-31
Vulnerability Type: Supply-chain exposure through unpinned package installation and execution
Risk Level: Medium

Vulnerable Code

bash

npm install -g @posteahora/cli
# or
pnpm install -g @posteahora/cli

markdown

The installed command is `posteahora`. It can also run via `npx @posteahora/cli`.

The same unsafe installation pattern is also documented at:

• README.md:49-62
• QUICK_START.md:5-9

Technical Analysis

The Skill instructs the agent to install or execute @posteahora/cli without pinning a reviewed package version or requiring integrity or provenance verification. Global installation also makes the selected package executable outside an isolated project environment. Using an unversioned npx command may download and immediately execute the package currently resolved by the registry.

The audited project contains only Markdown documentation and does not include the CLI implementation, a lockfile, an integrity hash, or another locally reviewable artifact. Consequently, this audit cannot verify the external package's lifecycle scripts, runtime behavior, credential handling, filesystem access, media-upload implementation, or network requests.

This behavior is relevant to the pre-scan warning concerning sensitive network transmission. The documented API-key validation, account discovery, analytics access, post publication, and media upload are consistent with the Skill's declared functionality. However, their implementation is delegated to the unreviewed dependency. The latest package resolved at installation time may differ from the version intended when the Skill was reviewed.

Attack Path

1. An attacker compromises the package publisher account, registry distribution path, or a future package release.
2. The malicious version is published under the same package name.
3. The agent follows the Skill instructions and runs an unversioned global installatio ...[truncated 1537 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to an explicitly reviewed version, for example:

   bash

   npm install -g @posteahora/cli@X.Y.Z
   

2. Prefer a project-local installation over a global installation and invoke the pinned local binary.

3. Commit a lockfile that records the exact resolved package and integrity metadata.

4. Verify package provenance, publisher identity, registry source, signatures where available, and integrity hashes before execution.

5. Avoid unversioned npx execution. If npx is retained, specify an exact version and prevent unexpected package resolution.

6. Include the reviewed CLI source or a reproducibly built, integrity-verified artifact in the audit scope.

7. Execute the CLI in a restricted environment with access only to required media files and configuration.

8. Use a narrowly scoped API key if the service supports scopes, and rotate it after suspected package or host compromise.

9. Document the exact network destinations used for authentication, API requests, and presigned uploads. Restrict outbound traffic to those expected destinations where practical.

10. Ensure the credential file has owner-only permissions and avoid passing live keys in command-line arguments, where process listings or shell history may expose them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation explains that omitting flags causes immediate publishing, but it does not prominently warn users that this can push content live to real public social accounts right away. In a publishing CLI, unclear or insufficiently emphasized guidance around irreversible public actions increases the risk of accidental posting, reputational harm, and unintended disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The quick-start explicitly demonstrates passing a live-looking API key on the command line (posteahora auth --key pah_live_xxxxxxxx) without any warning about secret handling. Command-line secrets can be exposed through shell history, process listings, terminal logging, screenshots, and CI logs, so normalizing this pattern increases the chance users will leak valid credentials.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 9)May include surrounding context.

md

The PosteAhora CLI is a thin, zero-dependency command-line interface to the
[PosteAhora](https://posteahora.com) public REST API. It lets developers, scripts,
CI pipelines, and AI agents automate social media publishing — create and schedule
posts, manage a content-idea backlog, upload media, and read analytics — across
every major network from one tool.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README encourages immediate publishing, public media uploads, and local storage of a live API key without clearly warning users that posts may go live publicly, uploaded media may become publicly accessible, and credentials may persist on disk. In an AI-agent context, this omission is risky because agents or scripts may perform irreversible public actions or mishandle secrets without human confirmation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 234)May include surrounding context.

md

| Setting | Source (in order of precedence) |
|---------|---------------------------------|
| API key | `--key` flag → `POSTEAHORA_API_KEY` → `~/.posteahora/config.json` |
| Base URL | `POSTEAHORA_API_URL` (default `https://api.posteahora.com/functions/v1/api`) |

---

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The skill instructs users to run npx @posteahora/cli without pinning a specific version, which causes execution of whatever package version is current at invocation time. This creates a supply-chain risk: a compromised newly published version, typosquat, or malicious dependency update could be fetched and executed automatically with the user's privileges.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation states that posteahora upload <file> returns a public URL, but it does not warn users that uploaded media may become publicly accessible and guessable/shareable beyond the intended audience. In a social publishing tool, this can lead to accidental exposure of sensitive, embargoed, or private media before or outside of controlled posting workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file advertises actions that can affect user data and external systems, including immediate publishing, scheduling, and media uploads. Under the markdown-specific SQP-2 criteria, the description should include some warning or disclosure about posting to connected accounts or transmitting media/content to the service.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: README.md:84