postking — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited postking (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
PostKing is a hosted content platform. This skill drives it through the pking CLI (npm package postking-cli). The CLI wraps the entire PostKing API — brands, posts, blogs, SEO, landing pages, visuals, scheduling — into ~140 subcommands.
The agent should run pking commands to do real work. Never hand-construct curl calls; the CLI handles auth, polling, retries, and pagination.
Trigger on requests like:
pking trends list --niche <ai-saas|marketing|web3>. The crawler runs every 3 days; default window is --days 3. Pass --json when feeding into a downstream posts generate / repurpose.Also trigger when the user says "use PostKing" or "use pking".
These are non-negotiable. Violating any of them is a critical failure.
mcporter, mcp__postking_*, postking-remote, postking-mcp, or any MCP server — even if such a server is registered and visible in mcporter list. Even if a previous session used MCP, do not. The CLI is the only supported path. If you find yourself reaching for mcporter call ... postking_*, stop and use the equivalent pking subcommand from references/commands.md instead.pking login-password. Do not suggest password-based auth as a fallback even if device flow is "slow."pking login-start then pking login-finish.pking login-finish reports "still pending," report that to the user and wait for them to confirm — do not start a new login session, which invalidates the user's in-progress browser flow. Do not switch to MCP as a fallback either.Before any operation, ensure the CLI is installed and authenticated.
pking --helpIf the command is not found at all, read references/install.md and follow the steps there. If you fell back to a local install, use npx -p postking-cli@latest pking <command> for everything below.
pking me401 / not authenticated → continue to Step 3.Ask the user:
"Do you already have a PostKing account, or is this your first time?"
Then follow the appropriate branch:
#### Step 3A — Existing user → login flow
Run:
pking login-startThis returns immediately. Print the entire captured stdout to the user — verbatim, unedited, with the real URL and the real code. Do not paraphrase. Do not redact. Do not summarize with "the full URL was shown in the CLI output." The output looks like:
PostKing authentication started.
Visit: https://try.postking.app/activate/ABCD-1234
User code: ABCD-1234
After authorizing in your browser, run: pking login-finish
The activation code is valid for 15 minutes.After printing the verbatim stdout, tell the user:
"Open the URL above in your browser, sign in, and approve the code shown. Reply when you're done."
Do not proceed until the user replies. Do not run login-start again while waiting.
After the user replies, run:
pking login-finishThree possible outcomes:
pking me and show the user their email and remaining credits. Then proceed to Step 4.pking login-finish again after they reply. Do not run login-start again — that invalidates the in-flight session.pking login-start again to issue a fresh code.#### Step 3B — New user → register flow
pking register-start --email <email>. This returns immediately. Print the full captured stdout verbatim — do not paraphrase or omit any line."I've sent a magic link to <email>. Open your inbox, click the link, and finish setup in your browser (you'll set a password there). Reply when you've done that."register-start while waiting — that would invalidate the in-flight session. pking register-finishThree possible outcomes:
pking me and show the user their account details and remaining credits. Then proceed to Step 4.pking register-finish again. Do NOT re-run `register-start` — that invalidates the in-flight session.pking register-start --email <email> again to issue a fresh magic link and repeat from step 2.Do NOT prompt for a password in chat. Do NOT direct the user to a static signup URL.
pking brand listpking brand set <brandId>.The most common one-shot calls. Always pass --help to a subcommand to see all flags.
| Goal | Command |
|---|---|
| Generate a post | pking posts generate --platform linkedin --variations 3 |
| Approve & schedule | pking posts approve <postId> --variation 2 --schedule 2026-05-01T14:00:00Z |
| Repurpose a URL | pking repurpose --source-type url --source-url <url> --target-type social --target-platforms linkedin,x |
| List upcoming posts | pking posts calendar |
| Generate a blog | pking blogs generate --publication <id> --topic "..." --keywords "kw1,kw2" |
| Publish a blog | pking blogs publish <articleId> |
| Onboard a brand from URL | pking onboard https://example.com --name "Acme" |
| Run SEO seeds | pking seo seeds "ai content" "social scheduling" |
| Generate keyword set | pking seo generate |
| Build SEO roadmap | pking seo roadmap |
| Generate a landing page | pking lp generate --topic "..." |
| Publish a landing page | pking lp publish <slug> |
For the full command catalog, read references/commands.md in this skill, or run pking --help and pking <group> --help.
Full chain — mirrors the web onboarding wizard end-to-end so a headless agent can drive setup without a browser:
pking onboard <websiteUrl> --name "<Name>" — top-level command. Crawls the site, analyzes audience, generates 10 themes. Async; the CLI prints progress and exits when done.pking brand mediums --set "<csv>" — pick the channels to grow on (e.g. linkedin,x/twitter,blog).pking brand mix --set '<json>' — confirm content intent mix (educate/connect/present/intrigue, sum = 100).pking brand themes list — review the 10 generated themes; edit/delete as needed.pking voice brand list — review attached voice profiles. Optional. Creating new voice profiles is web-only (extract endpoints) — direct the user to /dashboard/brands/{brandId}/voice-profiles if they want to add one.pking brand visual set --logo <url> --primary-color <hex> --secondary-color <hex> — set visual identity. pking brand visual import-assets --urls <csv> for additional crawled image URLs.pking brand smart-week --yes — generate the first Mon–Fri week of posts across the selected mediums. Runs in the background.pking brand finalize — mark the brand fully onboarded (brandSettings.isOnboarded = true).pking social check — confirm connected accounts. If empty, pking social connect opens a generic OAuth magic link, or pking social connect-platform --platform <linkedin|x|instagram|threads|facebook> for a platform-targeted link.pking posts approve <postId> --schedule <iso> — schedule the first post from the smart-week batch.pking weekly-schedule get — view the current cadence.pking weekly-schedule set --monday "linkedin:1,x:1" --timezone America/New_York --enable — define days/timezone/voice in one call.pking weekly-schedule run-day --date <YYYY-MM-DD> — generate all posts for a single day; review and approve.pking repurpose --source-type url --source-url <url> --target-type social --target-platforms linkedin,x,instagram — generates one post per platform from the URL's content. Returns post IDs.pking posts view <id>, then pking posts approve <id> --schedule <iso>.pking seo seeds <kw1> <kw2> <kw3> — register seed keywords.pking seo generate — expand into a full keyword set (~100 keywords). Long-running.pking seo categorize — tag intent.pking seo cluster — group into topic pillars.pking seo clusters list — show clusters; ask the user which to target.pking seo roadmap --cluster <clusterId> --items 20 — produce ~20 prioritized article topics from the cluster.pking seo write --roadmap-id <roadmapItemId> — draft an article.pking seo publish --article-id <articleId> — publish.pking lp generate --topic "..." — async; returns a slug + operation id.pking lp view <slug> — preview.pking lp edit <slug> --instructions "..." (AI edit pass) or pking lp vibe <slug> --instructions "..." --wait for full vibe edits. For specific sections of side-pages, pking lp side section <slug> <sideKey> --id <sectionId> ....pking lp publish <slug>.pking blogs generate, pking lp generate, pking lp vibe, and pking seo generate return operation/job ids and poll automatically — but if the agent needs to check status manually:
pking jobs list — returns both live brand jobs and recent operations merged and sorted newest-first; each row shows a source column (op = operation, job = legacy brand job). Supports --status and --limit filters. Prints a dashboard URL at the end.pking blogs status <articleId>pking lp vibe status <slug> <operationId>login-start → user authorizes → login-finish). Tell the user once; never silently loop.retryAfter is authoritative when present.checkoutUrl from the error envelope and stop. Do not retry, do not recap prior steps, do not promise what will happen after top-up. Example: Out of credits — top up at <checkoutUrl>.checkoutUrl. No recap, no next-step promises.pking brand list first. Never pick a brand silently — ask the user.references/install.md and follow the install steps there before continuing.pking visuals <verb> (no visuals-post namespace). upload needs --file <path>; import-url <url> and search-stock <query> are positional. A carousel does NOT require an uploaded asset — pking visuals carousel <postId> renders directly from the post's cards. If you hit 404s, re-read references/commands.md before suggesting the user upload anything.pking visuals options <postId> --platform <p> first, relay the numbered list to the user (especially the ► Recommended line and the card/quote text shown inline), and submit their choice with pking visuals pick <postId> --platform <p> --pick <N>. Do NOT hand-construct --style/--variant/--asset/--slot — --pick <N> reads the cache that options just wrote and resolves the right pickArgs.options prints the resolved render params under each row (colors, avatar, fonts, quote text). Use those when the user asks "what would this look like" — the params ARE the spec; you do not need to render anything.options footer prints a To change brand colors or default avatar: <url> line — surface that URL verbatim if the user wants different branding. They edit settings in the dashboard, then re-run options to see the new resolved params.--more flag. The canonical "load more" path is pking visuals regenerate <postId> --load-external, which pulls additional Unsplash + Pexels results. Re-run options afterwards.posts create / approve / reschedule, visuals pick, blogs generate / publish, lp generate / update / publish, surface the View in browser: <url> line to the user. The user is already logged into the dashboard, so the link works directly.After setup, this should always work:
pking meReturns the authenticated user's email, plan tier, and remaining free-tier quota.
pking brand listReturns at least one brand (active brand is starred).
If both succeed, the skill is fully operational.
For the complete pking surface (every group, every flag), read references/commands.md in this skill. The agent should consult it before running an unfamiliar command.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.