Kabuzz

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:42 AM UTC
• Version: 1.0.1

Overview

The skill is a disclosed marketplace integration, but it can run unpinned external code with a financial API key and gives agents off-session purchase and payment-management authority.

Review this before installing. Use only a narrowly scoped, revocable Kabuzz API key, set conservative spending limits, require human confirmation for purchases and payment changes, and prefer a pinned, verified MCP server version instead of the documented floating `npx` package.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Unpinned Third-Party Package Is Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24–32
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

yaml

metadata:
  openclaw:
    requires:
      env:
        - KABUZZ_API_KEY
      primaryEnv: KABUZZ_API_KEY
      bins:
        - npx
    mcp:
      command: npx
      args:
        - "@kabuzz/mcp-server"

The documented connection example at lines 67–74 confirms the same behavior:

json

{
  "mcpServers": {
    "kabuzz": {
      "command": "npx",
      "args": ["@kabuzz/mcp-server"],
      "env": {
        "KABUZZ_API_KEY": "kabuzz_agent_live_XXXXXXXXXXXXX"
      }
    }
  }
}

Technical Analysis

The Skill invokes @kabuzz/mcp-server through npx without specifying an exact package version or enforcing a reviewed integrity value. Depending on the local npm configuration and cache state, npx can retrieve and execute the package version currently resolved by the registry.

Consequently, the code that ultimately executes can change after this Skill has been audited. Compromise of the package publisher, npm account, package release process, or registry delivery path could cause a malicious future release to run automatically. The MCP process is also supplied with KABUZZ_API_KEY, which is documented as authorizing financially consequential marketplace operations.

The reviewed project contains only SKILL.md; therefore, the implementation of the external npm package was not available for inspection. This finding identifies an unsafe supply-chain configuration and does not assert that the current package is malicious.

Attack Path

1. An attacker compromises the npm publisher account, release pipeline, or another component capable of publishing @kabuzz/mcp-server.
2. The attacker publishes a malicious package release that is selected by the unversioned package reference.
3. A user loads the Skill and launches its MCP configuration.
4. `npx @kabuzz/mcp-server ...[truncated 1007 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed, exact version, for example:

   yaml

   mcp:
     command: npx
     args:
       - "--no-install"
       - "@kabuzz/mcp-server@1.0.0"
   

2. Install the pinned package through a lockfile-based deployment process and use npx --no-install so execution fails rather than downloading an unexpected package dynamically.

3. Verify package integrity using npm lockfile integrity metadata or an equivalent cryptographic verification mechanism.

4. Review package source and release artifacts before approving version updates. Automate dependency scanning while requiring explicit approval for changes.

5. Run the MCP server in a sandbox or dedicated low-privilege account with restricted filesystem, process, and network access.

6. Use a narrowly scoped, revocable API key and rotate it immediately if package compromise is suspected.

7. Require explicit human confirmation for financially consequential operations such as purchases, payment-method changes, offer acceptance, and shipping-label purchases.

8. Monitor API activity for anomalous transactions and provide a rapid key-revocation mechanism.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The skill launches an MCP server via npx using an unpinned package name, which allows the runtime to fetch whatever version is current at execution time. In a marketplace skill with payment and order capabilities, a compromised upstream package, typosquatted dependency, or breaking update could alter transaction behavior, exfiltrate the API key, or perform unauthorized commerce actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The example connection block also invokes npx with @kabuzz/mcp-server without an explicit version, reproducing the same supply-chain risk for users who copy the configuration. Because this skill can access payment methods and make off-session purchases, executing an unpinned remote package materially increases the risk of credential theft or unauthorized financial actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill exposes payment-method management capabilities but does not clearly warn that adding, removing, or changing default saved cards can directly affect billing integrity and future autonomous purchases. In a commerce skill where agents can transact on behalf of humans, that omission increases the chance of unsafe delegation and account misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly advertises purchase_listing as buying items off-session with no UI, but it does not present a prominent user-facing warning about autonomous charging risk at the point of capability description. In this context, the omission is dangerous because the skill is designed for real-money transactions, so users may underestimate that an agent can charge saved payment methods without interactive confirmation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.