registry / @kolbo/mcp / 1.72.2

@kolbo/mcp@1.72.2

Kolbo AI MCP Server - Generate images, videos, music, speech, and sound effects from Claude Code

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 37 file(s), 608 KB of source, external domains: api.kolbo.ai, app.kolbo.ai, assets.sketchfab.com, cdn.coverr.co, cdn.freesound.org, cdn.kolbo.ai, cdn.pixabay.com, cdn.sketchfab.com, coverr.co, fonts.googleapis.com, fonts.gstatic.com, freesound.org, gfbpxdkripkbbrcvoyeh.supabase.co, images.pexels.com, images.unsplash.com, kolbo-general-media.fra1.cdn.digitaloceanspaces.com, kolbo-general-media.fra1.digitaloceanspaces.com, kolbo.ai, kolboai-production.ams3.cdn.digitaloceanspaces.com, kolboai-production.ams3.digitaloceanspaces.com, media.kolbo.ai, media.sketchfab.com, pixabay.com, plus.unsplash.com, sites.kolbo.ai, sketchfab-prod-media.s3.amazonaws.com, sketchfab.com, videos.pexels.com, www.w3.org

Source & flagged code

3 flagged

bin/kolbo-mcp.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

3// Installer commands are additive aliases on the same public package:

4// `npx @kolbo/mcp install` → MCP configuration + bundled skill

5// `npx @kolbo/mcp skill` → bundled skill only

6// `npx @kolbo/mcp install-skill` → readable alias for skill-only

7// Anything else runs the MCP stdio server (the default).

8const command = process.argv[2];

9if (command === 'install' || command === 'skill' || command === 'install-skill') {

10 const installer = require('../src/install.js');

11 const run = command === 'install' ? installer.run : installer.runSkillOnly;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kolbo-mcp.jsView on unpkg · L9

12 run()

13 .then((code) => process.exit(code || 0))

14 .catch((err) => {

15 console.error('Kolbo install failed:', err && err.message ? err.message : err);

16 process.exit(1);

17 });

18} else {

19 // Keep official managed skill installs on the exact tree bundled with the

20 // MCP package selected by `@latest`. Unmanaged/user-authored skills are left

21 // alone. This is silent because stdout belongs to the MCP JSON transport.

22 require('../src/install.js').refreshManagedSkills();

23 require('../src/index.js');

24}

src/tools/_shared.jsView file

Lines 1-30javascript

1/* Shared helpers for MCP tools. No server.tool() registrations here.

2 *

3 * This file centralizes the URL-or-local-path → Buffer resolver used by

4 * every tool that accepts file-ish arguments (visual_dna, elements,

5 * first_last_frame, lipsync, video_from_video, transcription, media upload,

6 * future additions). It also owns the SSRF guard applied to any URL we

7 * fetch on the user's local machine.

8 *

9 * SSRF defense in depth:

10 * 1. Only http: / https: protocols.

skill/scripts/filmmaking/lint_prompt.pyView file

•path = skill/scripts/filmmaking/lint_prompt.py kind = build_helper sizeBytes = 9452 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skill/scripts/filmmaking/lint_prompt.pyView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code