Skills/npm/mcp

mcp@1.131.11

CAUTION· startup only

Publisher claims: "Kolbo AI MCP Server - Generate images, videos, music, speech, and sound effects from Claude Code" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher kolbo · publishing for 253 daysInstalls 18,198Last detonated 5d ago
What would fix thisWatchDispute verdict

Coverage

Started and answered initialize; the tool list did not come back ((node:836) [UNDICI-EHPA] Warning: EnvHttpProxyAgent is experimental, expect them to change at any time. (Use `node --trace-warnings ...` to show where the warning was created)). Authenticated tool behavior not tested.
Tested
server startup over stdio · MCP initialize · every file read, file written and host contacted by what ran
Not tested
the tool list · what the tools do when called with a real credential

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
KOLBO_API_KEYConfiguration, not credentials: CODEX_INTERNAL_ORIGINATOR_OVERRIDE, KOLBO_API_BASE, KOLBO_API_URL, KOLBO_CALLER_SESSION_ID, KOLBO_CHARACTER_SHEET_TIMEOUT_MS, KOLBO_HTTP_TIMEOUT_MS, KOLBO_MCP_APPS, KOLBO_MCP_WAIT_MS, KOLBO_PARTNER_PROFILE, KOLBO_SOCIAL_PLANNER, KOLBO_UPLOAD_TIMEOUT_MS
Where it talks to
kolbo.ai (its own)Also gstatic.com, digitaloceanspaces.com, pexels.com, unsplash.com, pixabay.com, coverr.co, freesound.org, sketchfab.com, amazonaws.com, elevenlabs.io, kie.ai, supabase.co — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list · what the tools do when called with a real credential

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names gstatic.com, digitaloceanspaces.com, pexels.com, unsplash.com, pixabay.com, coverr.co, freesound.org, sketchfab.com, amazonaws.com, elevenlabs.io, kie.ai, supabase.co as well as its own vendor. The guard injects KOLBO_API_KEY only into requests to kolbo.ai (and its subdomains) and refuses the rest.

$vet-skills run --secrets KOLBO_API_KEY=kolbo.ai -- npx -y @kolbo/mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; started and answered initialize; the tool list did not come back ((node:836) [UNDICI-EHPA] Warning: EnvHttpProxyAgent is experimental, expect them to change at any time. (Use `node --trace-warnings ...` to show where the warning was created)). Authenticated tool behavior not tested) on 2026-11-09 and scored it 75/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: README links to an external installer; URL with embedded credentials. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 27 s · 2 scenarios
t+CategoryObserved action
0.0sprocessno install scripts in bundle
6.3sprocessdependency install exit 0
26sfilesystemread ~/.config/kolbo/partner.json · ~/.local/share/kolbo/auth.json outside project
26sclaimedstartup only: answered initialize, no tool list · (node:836) [UNDICI-EHPA] Warning: EnvHttpProxyAgent is experimental, expect them to change at any time. (Use `node --trace-warnings ...` to show where the warning was created)
26sprocessscript backend runs setup only
26sprocessno install scripts to re-run

Static findings

MEDIUM
npx invocation of non-well-known packagesrc/index.js:43 · npx invocation of non-well-known package — may execute untrusted code* Users install via `npx -y @kolbo/mcp` — npx CACHES packages. A user whoFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/kolbo-mcp.js:4 · npx invocation of non-well-known package — may execute untrusted code// `npx @kolbo/mcp install` → MCP configuration + bundled skillFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/tools/chat.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/tools/moodboards.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/tools/artifacts.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedskill/scripts/micro-drama/media.py:9 · Python subprocess execution detectedout = subprocess.check_output(["ffprobe", "-v", "error", "-select_streams", "v:0", "-show_entries",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedskill/scripts/micro-drama/media.py:20 · Python subprocess execution detectedout = subprocess.check_output(["ffprobe", "-v", "error", "-select_streams", "v:0", "-show_entries",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/client.js:260 · npx invocation of non-well-known package — may execute untrusted code// Local stdio servers (raw `npx @kolbo/mcp` in Claude Desktop / Code / Cursor)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/tools/visual_dna.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/tools/review.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/tools/projects.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/index.js:97 · npx invocation of non-well-known package — may execute untrusted code* - the stdio entrypoint below (npx / Kolbo Code), andFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/skillResources.js:6 · npx invocation of non-well-known package — may execute untrusted code* Why: `skill/` is installed into a LOCAL agent by `npx @kolbo/mcp install`.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/tools/agents.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/tools/analyze.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
README links to an external installerREADME.md → https://kolbo.ai/skills/kolbo.ziphttps://kolbo.ai/skills/kolbo.zipFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/tools/models.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/tools/color_palettes.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedskill/scripts/micro-drama/cut.py:92 · Python subprocess execution detectedsubprocess.run(["ffmpeg", "-v", "error", "-y", *ins, "-filter_complex", fc.rstrip(";"), "-map", "[v]",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagebin/kolbo-mcp.js:6 · npx invocation of non-well-known package — may execute untrusted code// `npx @kolbo/mcp install-skill` → readable alias for skill-onlyFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/kolbo-mcp.js:5 · npx invocation of non-well-known package — may execute untrusted code// `npx @kolbo/mcp skill` → bundled skill onlyFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/tools/morphious_styles.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedskill/scripts/micro-drama/media.py:26 · Python subprocess execution detectedraw = subprocess.check_output(["ffmpeg", "-v", "error", "-i", video, "-vf",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedskill/scripts/micro-drama/shot_map.py:26 · Python subprocess execution detectedsubprocess.run(["ffmpeg", "-v", "error", "-y", *inputs, "-filter_complex",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/tools/docs.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/tools/media.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/tools/generate.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/index.js:6 · npx invocation of non-well-known package — may execute untrusted code* This package is published to npm and installed via `npx -y @kolbo/mcp`.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/tools/trends.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
URL with embedded credentialssrc/apps/html.js:20 · URL with embedded credentials — may be phishing or credential leaking<link href="https://fonts.googleapis.com/css2?family=Poppins:wght@400;500;600;700&display=swap" rel="stylesheet" media="print" onload="this.media='all'">Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Python subprocess execution detectedskill/scripts/micro-drama/burn.py:113 · Python subprocess execution detectedsubprocess.run(["ffmpeg", "-v", "error", "-y", "-i", os.path.abspath(a.video), "-vf", flt, "-c:v", "libx264",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/install.js:4 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp install` — one-command, keyless setup.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/index.js:229 · npx invocation of non-well-known package — may execute untrusted code// run `npx @kolbo/mcp install` — can still read the operating guidance.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/tools/presets.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈18,302 tok
1 file · 80 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @kolbo/mcp@1.131.11 as of 5d ago. This is the package itself, not its dependencies.

What would make this Verified

5 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs. Seen: ~/.config/kolbo/partner.json.
  2. Unclaimed publisher≈ +8 on the totalClaim kolbo: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  4. README links to an external installer≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  5. URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim kolboPropose a patch to the maintainer