Security audit

流程编辑专家

Security checks for vulnerabilities and agentic risk

Overview

This skill is for legitimate Node-RED administration, but it gives an agent broad authority to change live workflow systems with unclear activation boundaries and inconsistent execution guidance.

Install only if you intend to let an agent administer Node-RED instances. Before use, restrict it to named dev/staging/prod instances, require explicit confirmation for production deploy, delete, restore, rollback, context writes, node changes, Docker restarts, and scheduled backups, and keep Node-RED credentials and backup files in protected secret storage.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill gives conflicting guidance about whether it is exec-driven or pure Markdown-only, which can cause an agent or operator to choose an unsafe execution path. In a skill that manages Node-RED, Docker, backups, restores, and deployments, ambiguity around execution semantics increases the chance of unintended command execution or bypass of expected safeguards.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The generic input_params/config_options/output_format implementation description contradicts the rest of the document, which is centered on shell/CLI operations against live Node-RED instances. This mismatch can cause tooling to misclassify the skill as structured-data processing while it actually performs privileged infrastructure actions, undermining policy enforcement and review.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The activation description is broad enough to match common coding, debugging, and deployment requests, which can cause this high-privilege operational skill to be invoked outside narrowly intended Node-RED admin scenarios. That expands the chance of accidental use of exec/write capabilities and operational changes on live systems.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The capability coverage section uses vague keyword matching to define scope, which can trigger the skill for loosely related requests. Because the skill includes exec, write, Docker operations, restore, rollback, and deletion paths, overbroad matching materially raises the risk of unintended high-impact actions.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill documents destructive and service-impacting actions such as deploy, restore, delete, rollback, and Docker restarts without a clear mandatory warning or confirmation policy at the point of action. In this context, these commands target production workflow infrastructure and can cause outages, data loss, or service disruption if triggered accidentally or under ambiguous user intent.

Static analysis

No suspicious patterns detected.