onboarding — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited onboarding (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The zero-to-first-post skill. Gets a new user authenticated, with a brand profile, reviewed themes, connected socials, and a scheduled post — paced one stage at a time so the user stays in control.
Setup. This skill requires the pking CLI. If command -v pking fails, run npm i -g postking-cli. To authorize, run pking login and follow the URL it prints. You only need to do this once per machine.
"I'm new. Set up PostKing for my site https://acme.com."
Onboarding is an explicit multi-step flow. Hermes (the agent driving this skill) MUST obey these rules:
pking me — if this returns a user object, the user is already authenticated; inspect the Brands: count and Active brand: fields in the output to pick the right branch below.pking me brand state:Active brand: none with no brands listed): the agent MUST stop and explicitly onboard the user before doing anything else. Frame it warmly — tell the user PostKing needs a brand to do anything useful, and offer to set one up now. Then ask two questions in plain prose, in this order: (1) "What's the name of the brand you want to set up?", (2) "What's the website URL we should analyse for it?" If the UI supports turn-by-turn questions, ask one per turn; wait for the user's actual answers in the current conversation. Do NOT reuse a brand name or URL the agent remembers from a prior conversation or long-term memory, even if it seems plausible — if a prior-context value exists, surface it as a suggestion only (e.g. "Last time you mentioned acme.com — still the right one, or different?") and wait for explicit confirmation. Only after both answers are confirmed does the agent proceed to Stage 2 with those values.pking brand list to surface existing brands and ask the user which one to make active (pking brand set <id>), or whether they want to add a new one. "Add another brand" is the only path that proceeds to Stage 2; selecting an existing brand skips Stage 2 and Stage 3 — run pking brand info to confirm the audience analysis is already in place.pking login-start → show the URL and code to the user → wait for them to confirm they've completed the browser step → pking login-finish.pking onboard, you MUST ask the user — in the current conversation — for the website URL and brand name. Do NOT reuse a URL or brand name remembered from any prior conversation, prior session, or long-term memory. Always confirm with the user in this conversation, even if a plausible value seems known from earlier context. If only one brand context is plausibly known, still surface it and ask "Use <url> as <name>, or give me a different site?" rather than running the command silently.pking onboard <websiteUrl> --name "<Name>" — crawls, analyzes audience, generates 10 themes. Typically 30–90s. The command also prints a first-pass reveal of what was learned.pking brand create <name> --description "..." --tone "..." --audience "..." for manual setup without crawling.pking brand info to pull the full audience + positioning analysis (audience demographics, psyche, pain points, awareness levels, market dynamics, product context) from the agent v1 audience endpoint.https://postking.app/dashboard/brands/<brandId>/audience-review to refine, or capture their corrections so they can be applied later (via pking brand PATCH-style commands when available).pking brand info reports that audience analysis hasn't run yet, wait a minute and retry once on the user's say-so — do not loop silently.pking brand themes — full list of the generated themes with descriptions.pking brand themes edit <themeId> --title "..." --content "..." --intent "..." or pking brand themes delete <themeId>.pking brand generate-themes --count <n> (n ≤ 10).https://postking.app/dashboard/brands/<brandId>/audience-review?onboarding=true (or the brand voice settings) and have them follow the in-app "Share your best profile" step.pking social check — see what accounts are connected.pking social connect-platform --platform <linkedin|x|instagram|threads|facebook> — generate an OAuth magic link pre-targeted to a platform. Show the URL to the user and ask them to confirm once they've completed the OAuth flow.pking posts generate --platform <platform> --variations 3pking posts approve <postId> --variation <n> --schedule <iso> — locks it in.pking posts calendar — confirm the post appears in the upcoming schedule.UNAUTHORIZED — re-run pking login-start to start a fresh device flow.TRIAL_EXPIRED — upgrade via the checkoutUrl returned in the error envelope.VALIDATION — invalid email format or missing required field.NOT_FOUND on the audience reveal — audience analysis hasn't finished yet; wait briefly and ask the user before retrying.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.