T08 · Insecure Dependencies
Warning
- Location
SKILL.md:5- Finding
Unpinned Third-Party CLI Is Downloaded and Executed Through npx
- Content
View full analysis
` 3. **List integrations** — `npx @wahlu/cli integration list` (get integration IDs for scheduling) 4. **Create a post** — `npx @wahlu/cli post create --name "Title" --instagram '{"description":"Caption","post_type":"grid_post"}'` 5. **Schedule it** — `npx @wahlu/cli schedule create --at 2026-03-15T14:00:00Z --integrations ` 6. **Upload media** — `npx @wahlu/cli media upload ./photo.jpg` (returns a media ID) 7. **Check publications** — `npx @wahlu/cli publication list` ``` ```bash npx @wahlu/cli media upload ./photo.jpg npx @wahlu/cli post create --name "New product launch" \ --instagram '{"description":"Just launched!","post_type":"grid_post","media_ids":["mid-abc123"]}' \ --tiktok '{"description":"Just launched!","post_type":"image","media_ids":["mid-abc123"]}' \ --linkedin '{"description":"Just launched!","post_type":"li_image","media_ids":["mid-abc123"]}' npx @wahlu/cli schedule create \ --at 2026-03-15T09:00:00Z \ --integrations int-123 int-456 int-789 ``` ### Technical Analysis The package reference `@wahlu/cli` has no exact version or integrity constraint. Every documented `npx @wahlu/cli` invocation can therefore resolve to a package version selected by the npm registry at execution time rather than to the version reviewed when this skill was audited. A ...[truncated 1939 chars]- Remediation
View remediation