Flow Manager Pro Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:26 AM UTC
• Version: 1.0.0

Overview

This Node-RED admin helper is purpose-aligned, but it needs review because it tells agents to run an unbundled CLI with admin credentials and includes high-impact operations with limited safeguards.

Review before installing. Use only a verified flow-manager CLI from a trusted source, avoid storing administrator credentials in a broadly readable .env file, do not run destructive commands against production without explicit confirmation and backups, and do not disable TLS certificate verification except in isolated test environments.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:289

Finding

Unverified and Missing CLI Enables PATH-Based Tool Spoofing

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49-55, 82-110, and 285-291
Vulnerability Type: T07: Skill Instruction Hijacking and Spoofing
Risk Level: High

Vulnerable Code Snippet

bash

# Verify the connection
flow-manager list-flows

# View instance settings
flow-manager get-settings

# Deploy a flow
flow-manager deploy --file assets/flows/example.json

bash

# Install a node
flow-manager install-node node-red-contrib-http-request

The dependency table at line 289 declares the flow-manager CLI mandatory and claims that it is provided with the Skill. However, the audited package contains only SKILL.md; the declared executable, installation mechanism, source reference, version pin, checksum, and signature are absent.

Technical Analysis

The Skill grants itself exec capability and repeatedly instructs the Agent to invoke flow-manager by its bare executable name. A shell resolves a bare name through the current PATH. Because the package does not contain the claimed executable or define a verified absolute path, the identity and integrity of the executed program cannot be established.

An attacker able to place a malicious executable named flow-manager earlier in PATH could cause apparently legitimate Skill operations to execute attacker-controlled code. The spoofed process would run with the Agent's operating-system privileges and inherit relevant environment variables. These may include NODE_RED_USERNAME and NODE_RED_PASSWORD, as documented at lines 45-47 and 295-297.

The executable would also receive flow filenames and other command arguments. It could steal credentials and flow definitions, tamper with files, impersonate successful deployments, or perform unrelated commands within the Agent's permission boundary.

The absent .env.example and assets/flows/example.json further demonstrate that the documented package contents and the actual package do n ...[truncated 1850 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the CLI implementation in the package if it is intended to be bundled, or provide a canonical and authenticated distribution source.
2. Pin the CLI to an reviewed version and publish a cryptographic checksum or signature.
3. Verify the executable's signature or checksum before the first invocation and after upgrades.
4. Invoke the CLI through a fixed, trusted absolute path rather than relying on ambient PATH resolution.
5. Refuse execution when the resolved executable is outside the approved installation directory.
6. Document an exact installation and verification procedure, including expected publisher, version, hash, and permissions.
7. Run the CLI with a restricted environment and pass only variables required for the requested operation.
8. Avoid exposing administrator credentials to unverified child processes; use scoped tokens or a dedicated secret-injection mechanism where Node-RED supports them.
9. Add explicit user confirmation before node installation, node removal, flow deletion, or other destructive operations.
10. Supply or remove references to the missing .env.example and example flow assets so documentation accurately reflects package contents.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:270

Finding

TLS Certificate Verification Can Be Disabled for Privileged Node-RED Operations

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 270
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code Snippet

text

NODE_RED_REJECT_UNAUTHORIZED=false

The surrounding guidance recommends this setting for self-signed certificates and limits it textually to test environments. The restriction is not technically enforced.

Technical Analysis

Setting NODE_RED_REJECT_UNAUTHORIZED=false disables validation of the TLS certificate presented by the Node-RED endpoint. Encryption without certificate authentication does not establish that the client is communicating with the intended server.

This Skill performs privileged Admin API operations and uses administrator credentials. If certificate verification is disabled, a network-positioned attacker can present any certificate, impersonate the configured Node-RED endpoint, and terminate the TLS connection without being rejected.

The attacker can then capture credentials or tokens sent to the false endpoint, return fabricated API responses, collect flow definitions, or modify privileged requests before relaying them to the real service. The phrase “test environments only” reduces neither the technical exploitability nor the consequences if the setting is accidentally retained in CI, staging, or production.

Attack Path

1. A user follows the self-signed-certificate guidance and sets NODE_RED_REJECT_UNAUTHORIZED=false.
2. The Agent invokes the CLI to connect to an HTTPS Node-RED Admin API.
3. An attacker obtains a network interception position, such as through a malicious proxy, compromised gateway, poisoned DNS, or hostile test network.
4. The attacker presents an arbitrary TLS certificate for an impersonated Node-RED endpoint.
5. Because certificate verification is disabled, the client accepts the certificate.
6. The Agent transmits authentication material and privileged API requests to the attacker- ...[truncated 1046 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove guidance that globally disables TLS certificate verification.
2. For private or self-signed certificates, configure the CLI with a trusted CA bundle containing the specific development CA.
3. Alternatively, support certificate or public-key pinning for controlled test instances.
4. Fail closed when certificate validation fails; do not silently retry with validation disabled.
5. If an emergency bypass must exist, make it a one-command option rather than a persistent environment variable.
6. Require an explicit warning and user confirmation for every bypassed connection.
7. Restrict any exceptional bypass to loopback addresses and prevent its use for remote hosts.
8. Ensure CI and production configurations reject startup when the bypass variable is set to false.
9. Prefer short-lived, narrowly scoped credentials so intercepted secrets cannot provide indefinite administrator access.
10. Document certificate-authority installation procedures for Windows, macOS, Linux, containers, and CI runners.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The skill explicitly relies on storing and using administrative Node-RED credentials via a .env file, and the allowed-tools include exec, meaning an agent could operate with privileged secrets in a command-execution context. In this environment, credential exposure through filesystem access, logs, shell history, process inspection, or downstream tooling could enable full administrative takeover of the Node-RED instance.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

bash

# 1. 复制环境配置模板
cp .env.example .env

# 2. 编辑.env，填入Node-RED实例信息
# NODE_RED_URL=http://localhost:1880

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to place Node-RED administrator credentials into a local .env file but does not prominently warn about secret handling, file permissions, process/environment leakage, or safer secret stores. In an admin-automation skill, these credentials grant powerful control over flows and nodes, so weak storage guidance meaningfully raises the risk of credential disclosure and subsequent instance compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill presents destructive administrative operations such as flow deployment, update, and deletion without requiring confirmation, warning about production impact, or recommending backup first. In the context of a Node-RED Admin API management skill, these commands can immediately alter or remove live automation logic, causing outages or unsafe process changes if triggered by mistake or prompt manipulation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Node installation, enablement, disablement, and removal change the runtime capabilities of the managed Node-RED instance and may introduce untrusted code or break dependent flows. Because the skill normalizes these actions without warnings, dependency checks, or confirmation, it increases the chance of service disruption and unsafe package changes in a privileged admin context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

manifest描述将范围限定为流程列表、部署、状态查询与基础节点管理，FAQ也将免费版聚焦在这些核心高频操作及基础备份。然而“上下文管理”章节不仅支持读取，还支持 set-context 修改 flow/global 上下文，这属于额外的实例状态修改能力，超出顶部描述声明。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

清单与FAQ/限制章节将免费版范围描述为流程列表、部署、状态、基础节点管理与基础备份，并明确写出“不含完整备份恢复”“不含流程版本对比与回滚”。但CI场景示例却指导使用 flow-manager restore last-known-good.json 执行恢复/回滚，这超出了已声明的免费版能力范围，构成描述与行为范围不一致。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The document explicitly states that it has been fully localized for Chinese users and the operative instructions throughout the skill are only in Chinese, with no indication that users may choose another language. This can be a language/locale policy issue when a skill effectively forces one language without opt-in or alternative support.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.