Node Red Manager

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:20 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent Node-RED admin tool, but it gives an agent broad live automation control without enough safeguards.

Install only for trusted Node-RED instances, prefer HTTPS for any non-local endpoint, use least-privilege credentials, review every deploy/delete/restore/context/node-install action before running it, and treat flow backups as sensitive files. Avoid using it against production automation without manual change review and rollback backups.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/nr_api.py:13

Finding

Node-RED administrator credentials may be transmitted over plaintext HTTP

Content

View full analysis

bool: url = f"{self.base_url}/auth/token" payload = { "client_id": "node-red-admin", "grant_type": "password", "scope": "*", "username": self.username, "password": self.password } try: resp = requests.post(url, json=payload, timeout=API_TIMEOUT) ``` ### Technical Analysis The Node-RED endpoint is configurable and may use an `http://` URL. The implementation does not reject plaintext HTTP when the destination is a non-loopback host. During authentication, the administrator username and password are placed in a JSON request body and transmitted to `/auth/token`. Subsequent API requests also send the returned bearer token to the same endpoint. The localhost HTTP default is reasonable for a Node-RED instance accessed entirely through the local loopback interface. However, the documented configuration supports a remote endpoint without enforcing TLS. If a user configures a remote plaintext URL, credentials and tokens are vulnerable to passive network capture or active man-in-the-middle interception. This network communication is necessary for the declared Node-RED management functionality and is directed only to the configured Node-RED insta ...[truncated 1305 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned dependencies and unrestricted third-party Node-RED module installation create supply-chain risk

Content

View full analysis

Dict[str, Any]: self._validate_module_name(module) return self._make_request("POST", "/nodes", json_data={"module": module}) ``` The module-name validation only checks the string format: ```python def _validate_module_name(self, module: str) -> None: if not module or not isinstance(module, str): raise ValueError("Module name must be a non-empty string") if not re.match(r'^[@a-zA-Z0-9._/-]+$', module): raise ValueError("Module name contains invalid characters") ``` ### Technical Analysis The Python dependencies have no exact version pins or hashes. Installation can therefore resolve to different package versions over time, weakening reproducibility and increasing exposure to a compromised or unexpectedly incompatible release. The Node-RED installation command accepts any syntactically valid module identifier and submits it to the administrative `/nodes` endpoint. The regular expression prevents many malformed values but does not establish package trust, verify package integrity, constrain versions, or prevent typo-squatted names. Installing a Node-RED module can execute package lifecycle code during installation and runtime code when the module is loaded. Node installation is an explicitly declared feature of the Skill, so the behavior is not a hidden remote-payload mechanism. Nevertheless, it provides a supply-chain code-execution channel and should have controls appropriate to the privileges of the Node-RED service. ### Attack Path A represe ...[truncated 1741 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/admin-api.md (reported line 34)May include surrounding context.

md

- **CLI**: `scripts/nr update-flow <flow-id> --file <file>`

### Delete Flow
- **Endpoint**: `DELETE /flow/:id`
- **Description**: Delete specific flow
- **CLI**: `scripts/nr delete-flow <flow-id>`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/admin-api.md (reported line 72)May include surrounding context.

md

- **CLI**: `scripts/nr enable-node <module>` or `scripts/nr disable-node <module>`

### Remove Node
- **Endpoint**: `DELETE /nodes/:module`
- **Description**: Remove a node module
- **CLI**: `scripts/nr remove-node <module>`

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The restore path reads a local file and immediately deploys its contents to Node-RED, replacing or altering active automation without any confirmation step. This is dangerous because a malformed or malicious backup can cause service disruption, logic tampering, or unsafe device actions, especially given the skill’s direct administrative access.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documents capabilities that require environment access, filesystem reads/writes, and network interaction, but it declares no explicit tool scope or permissions boundaries. In an agent setting, this can lead to over-broad execution authority, making it easier for the skill to access credentials in .env, modify local files, and call the Node-RED admin API without clear confinement.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases "build automation," "connect devices," and "fix node-red" are broad enough to match many unrelated user requests, which increases the chance this skill is invoked unexpectedly. Because the skill can perform administrative and destructive actions against a live Node-RED instance, accidental invocation could cause unauthorized changes or disclosure of sensitive runtime information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation includes destructive and state-changing commands such as deploy, update, delete, restore, install/remove nodes, set context, and restart operations, but it does not warn about service impact or require confirmation before execution. In a production automation platform, these actions can break workflows, erase configurations, introduce malicious or vulnerable nodes, or cause downtime if run accidentally or through prompt-triggered misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This reference documents multiple state-changing and destructive administrative actions such as deploying flows, deleting flows, changing runtime state, installing/removing nodes, and setting context, but it does not consistently warn that these operations can disrupt automations, alter production behavior, or remove components. In an agent skill context, terse action-oriented docs can encourage an automated agent to perform high-impact changes without adequate confirmation, backup, or rollback planning.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/nr_api.py (reported line 47)May include surrounding context.

python

if method.upper() == "GET":
                resp = requests.get(url, headers=headers, params=params, timeout=API_TIMEOUT)
            elif method.upper() == "POST":
                resp = requests.post(url, headers=headers, json=json_data, data=data, timeout=API_TIMEOUT)
            elif method.upper() == "PUT":
                resp = requests.put(url, headers=headers, json=json_data, timeout=API_TIMEOUT)
            elif method.upper() == "DELETE":

Tainted flow: 'data' from requests.get (line 104, network input) → requests.post (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/nr_api.py (reported line 47)May include surrounding context.

python

if method.upper() == "GET":
                resp = requests.get(url, headers=headers, params=params, timeout=API_TIMEOUT)
            elif method.upper() == "POST":
                resp = requests.post(url, headers=headers, json=json_data, data=data, timeout=API_TIMEOUT)
            elif method.upper() == "PUT":
                resp = requests.put(url, headers=headers, json=json_data, timeout=API_TIMEOUT)
            elif method.upper() == "DELETE":

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/nr_api.py (reported line 49)May include surrounding context.

python

elif method.upper() == "POST":
                resp = requests.post(url, headers=headers, json=json_data, data=data, timeout=API_TIMEOUT)
            elif method.upper() == "PUT":
                resp = requests.put(url, headers=headers, json=json_data, timeout=API_TIMEOUT)
            elif method.upper() == "DELETE":
                resp = requests.delete(url, headers=headers, timeout=API_TIMEOUT)
            else:

Tainted flow: 'data' from requests.get (line 104, network input) → requests.post (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/nr_api.py (reported line 61)May include surrounding context.

python

if method.upper() == "GET":
                    resp = requests.get(url, headers=self._get_headers(), params=params, timeout=API_TIMEOUT)
                elif method.upper() == "POST":
                    resp = requests.post(url, headers=self._get_headers(), json=json_data, data=data, timeout=API_TIMEOUT)
                elif method.upper() == "PUT":
                    resp = requests.put(url, headers=self._get_headers(), json=json_data, timeout=API_TIMEOUT)
                elif method.upper() == "DELETE":

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/nr_api.py (reported line 102)May include surrounding context.

python

}
        
        try:
            resp = requests.post(url, json=payload, timeout=API_TIMEOUT)
            if resp.status_code == 200:
                data = resp.json()
                self.token = data.get("access_token")

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill exposes Node-RED context read/write operations, which can access or modify runtime state that may contain secrets, tokens, device state, or business logic inputs. Because this capability is broader than the described use case, it creates an unnecessary avenue for data exfiltration and unauthorized state manipulation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill adds local filesystem backup and restore capabilities that go beyond simple Admin API brokering and can write sensitive flow definitions to arbitrary local files, then redeploy them later. In an agent setting, this expands the blast radius from remote Node-RED management into local data persistence and destructive restore behavior, increasing the risk of secret exposure and unintended system modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The backup operation silently writes full flow data to disk, which may include credentials, endpoints, and sensitive automation logic. In an agent environment, creating local artifacts without an explicit warning or consent can leak sensitive data and leave it behind in unexpected locations.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency requests is unpinned, so installs may resolve to different versions over time, including versions with known security defects or breaking behavior. In a skill that manages Node-RED instances via admin APIs, HTTP client behavior is security-relevant, so leaving the version unconstrained increases supply-chain and exposure uncertainty.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests
python-dotenv

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

requests has multiple published advisories, and because no version is pinned, there is no way to verify whether the deployed version includes fixes. In a tool that communicates with Node-RED Admin APIs, an affected HTTP library could contribute to credential leakage, TLS verification issues, or other request-handling weaknesses depending on the resolved version.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency python-dotenv is unpinned, which makes builds non-reproducible and can silently pull in vulnerable or behavior-changing releases. Because this skill likely handles environment-based credentials for Node-RED access, uncertainty in dotenv parsing and file-handling behavior increases operational and security risk.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

requests
python-dotenv

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

python-dotenv has known advisories, and the unpinned manifest prevents verification that a safe release will be installed. Since environment files often carry tokens, URLs, or admin secrets for Node-RED management, using an unverified version can expose the skill to file-handling or secret-loading issues if a vulnerable release is selected.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.