node-red-manager

SUSPICIOUS: the stated purpose matches needing Node-RED credentials, but the footprint is a third-party transitive skill install through an unpinned `npx` command, with no code shown to verify how credentials are used. This is not confirmed malware, but it carries medium risk from installer trust, third-party skill inheritance, and limited data-flow transparency.