Skills/npm/mcp

mcp@1.137.10

CAUTION· startup only

Publisher claims: "Kolbo AI MCP Server - Generate images, videos, music, speech, and sound effects from Claude Code" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher kolbo · publishing for 254 daysInstalls 20,466Last detonated 7 min ago
What would fix thisWatchDispute verdict

Coverage

Started and answered initialize; the tool list did not come back ((node:806) [UNDICI-EHPA] Warning: EnvHttpProxyAgent is experimental, expect them to change at any time. (Use `node --trace-warnings ...` to show where the warning was created)). Authenticated tool behavior not tested.
Tested
server startup over stdio · MCP initialize · every file read, file written and host contacted by what ran
Not tested
the tool list · what the tools do when called with a real credential

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
KOLBO_API_KEYConfiguration, not credentials: CODEX_INTERNAL_ORIGINATOR_OVERRIDE, KOLBO_ALLOW_SENSITIVE_LOCAL_FILES, KOLBO_API_BASE, KOLBO_API_URL, KOLBO_CALLER_SESSION_ID, KOLBO_CHARACTER_SHEET_TIMEOUT_MS, KOLBO_HTTP_TIMEOUT_MS, KOLBO_MCP_APPS, KOLBO_MCP_WAIT_MS, KOLBO_PARTNER_PROFILE, KOLBO_SOCIAL_PLANNER, KOLBO_UPLOAD_TIMEOUT_MS
Where it talks to
kolbo.ai (its own)Also gstatic.com, digitaloceanspaces.com, openoffice.org, pexels.com, unsplash.com, pixabay.com, coverr.co, freesound.org, sketchfab.com, amazonaws.com, elevenlabs.io, kie.ai, supabase.co — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list · what the tools do when called with a real credential

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names gstatic.com, digitaloceanspaces.com, openoffice.org, pexels.com, unsplash.com, pixabay.com, coverr.co, freesound.org, sketchfab.com, amazonaws.com, elevenlabs.io, kie.ai, supabase.co as well as its own vendor. The guard injects KOLBO_API_KEY only into requests to kolbo.ai (and its subdomains) and refuses the rest.

$vet-skills run --secrets KOLBO_API_KEY=kolbo.ai -- npx -y @kolbo/mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; started and answered initialize; the tool list did not come back ((node:806) [UNDICI-EHPA] Warning: EnvHttpProxyAgent is experimental, expect them to change at any time. (Use `node --trace-warnings ...` to show where the warning was created)). Authenticated tool behavior not tested) on 2026-11-15 and scored it 63/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Privileged sudo command; README links to an external installer. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 29 s · 2 scenarios
t+CategoryObserved action
0.0sprocessno install scripts in bundle
7.1sprocessdependency install exit 0
28sfilesystemread ~/.config/kolbo/partner.json · ~/.local/share/kolbo/auth.json outside project
28sclaimedstartup only: answered initialize, no tool list · (node:806) [UNDICI-EHPA] Warning: EnvHttpProxyAgent is experimental, expect them to change at any time. (Use `node --trace-warnings ...` to show where the warning was created)
28sprocessscript backend runs setup only
28sprocessno install scripts to re-run

Static findings

MEDIUM
npx invocation of non-well-known packagesrc/tools/chat.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/tools/presets.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/tools/agents.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathssrc/localPathPolicy.js:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/^\.env\.(?!example$|sample$|template$|dist$).+$/, // .env.productionFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandskills/docx/SKILL.md:192 · Privileged sudo command — agent may execute with elevated privileges- **pandoc**: `sudo apt-get install pandoc` (for text extraction)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/tools/avatars.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/tools/color_palettes.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
README links to an external installerREADME.md → https://kolbo.ai/skills/kolbo.ziphttps://kolbo.ai/skills/kolbo.zipFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/index.js:98 · npx invocation of non-well-known package — may execute untrusted code* - the stdio entrypoint below (npx / Kolbo Code), andFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/tools/generate.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/kolbo-mcp.js:4 · npx invocation of non-well-known package — may execute untrusted code// `npx @kolbo/mcp install` → MCP configuration + bundled skillFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Privileged sudo commandskills/docx/SKILL.md:194 · Privileged sudo command — agent may execute with elevated privileges- **LibreOffice**: `sudo apt-get install libreoffice` (for PDF conversion)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedskills/xlsx/recalc.py:31 · Python subprocess execution detectedsubprocess.run(['soffice', '--headless', '--terminate_after_init'],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsskills/supabase/SKILL.md:11 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…lready have Supabase set up in this project (no `opencode.json` MCP config, no `.env.local` with Supabase vars, no AGENTS.md mentioning Supabase), STOP and load the…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandskills/docx/SKILL.md:195 · Privileged sudo command — agent may execute with elevated privileges- **Poppler**: `sudo apt-get install poppler-utils` (for pdftoppm to convert PDF to images)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/skillResources.js:6 · npx invocation of non-well-known package — may execute untrusted code* Why: `skill/` is installed into a LOCAL agent by `npx @kolbo/mcp install`.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/tools/models.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionskills/pptx/SKILL.md:403 · File type combined with upload action — agent may exfiltrate local data filespython scripts/replace.py working.pptx replacement-text.json output.pptxFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagesrc/index.js:231 · npx invocation of non-well-known package — may execute untrusted code// run `npx @kolbo/mcp install` — can still read the operating guidance.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathssrc/localPathPolicy.js:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'/mozilla/firefox/', '/.mozilla/', '/library/keychains/', '/etc/shadow', '/etc/sudoers',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/tools/analyze.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
URL with embedded credentialssrc/apps/html.js:20 · URL with embedded credentials — may be phishing or credential leaking<link href="https://fonts.googleapis.com/css2?family=Poppins:wght@400;500;600;700&display=swap" rel="stylesheet" media="print" onload="this.media='all'">Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
npx invocation of non-well-known packagesrc/tools/artifacts.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/install.js:4 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp install` — one-command, keyless setup.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/client.js:260 · npx invocation of non-well-known package — may execute untrusted code// Local stdio servers (raw `npx @kolbo/mcp` in Claude Desktop / Code / Cursor)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/index.js:6 · npx invocation of non-well-known package — may execute untrusted code* This package is published to npm and installed via `npx -y @kolbo/mcp`.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/kolbo-mcp.js:6 · npx invocation of non-well-known package — may execute untrusted code// `npx @kolbo/mcp install-skill` → readable alias for skill-onlyFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/tools/media.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Privileged sudo commandskills/pptx/SKILL.md:502 · Privileged sudo command — agent may execute with elevated privileges- **Poppler**: `sudo apt-get install poppler-utils` (for pdftoppm to convert PDF to images)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/localPathPolicy.js:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/^(.*\.)?env$/, // .env, prod.envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/index.js:43 · npx invocation of non-well-known package — may execute untrusted code* Users install via `npx -y @kolbo/mcp` — npx CACHES packages. A user whoFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/tools/moodboards.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/kolbo-mcp.js:5 · npx invocation of non-well-known package — may execute untrusted code// `npx @kolbo/mcp skill` → bundled skill onlyFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedskills/xlsx/recalc.py:92 · Python subprocess execution detectedresult = subprocess.run(cmd, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/tools/docs.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Privileged sudo commandskills/pptx/SKILL.md:501 · Privileged sudo command — agent may execute with elevated privileges- **LibreOffice**: `sudo apt-get install libreoffice` (for PDF conversion)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/tools/morphious_styles.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedskills/xlsx/recalc.py:84 · Python subprocess execution detectedsubprocess.run(['gtimeout', '--version'], capture_output=True, timeout=1, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/tools/review.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/tools/trends.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/tools/visual_dna.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/tools/projects.js:3 · npx invocation of non-well-known package — may execute untrusted code* `npx @kolbo/mcp` installs in the wild will break silently. Add new tools orFix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈35,222 tok
6 files · 80 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Not checked against OSV yet; the weekly check has not reached this version.

What would make this Verified

17 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs. Seen: ~/.config/kolbo/partner.json.
  2. Unclaimed publisher≈ +8 on the totalClaim kolbo: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. README links to an external installer≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim kolboPropose a patch to the maintainer