Node-RED
Pass
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a comprehensive reference and template library for Node-RED automations. It includes detailed guides on core concepts, context storage, and error handling.
- [CREDENTIALS_SAFE]: The documentation and templates consistently use placeholders (e.g.,
CHANGE_ME,your-secret-key) or environment variables (env.get('API_KEY')) for sensitive information like API tokens and passwords, preventing accidental credential exposure. - [DATA_EXPOSURE]: The skill includes a dedicated security reference (
references/security.md) that teaches users how to implement IP whitelisting, HMAC signature validation for webhooks, and input sanitization to protect their home automation system. - [EXTERNAL_DOWNLOADS]: Instructional content for installing Node-RED and its dependencies points to well-known technology services such as NodeSource and official NPM/GitHub repositories. These are documented for user implementation and do not involve automated malicious downloads by the agent.
- [COMMAND_EXECUTION]: Shell commands provided in the installation and troubleshooting guides are standard administrative tasks (e.g.,
npm install,systemctl restart) intended for the user's setup process. There is no evidence of the agent attempting to execute arbitrary or unauthorized commands. - [INDIRECT_PROMPT_INJECTION]: Although the skill is designed to process user automation requests and external API data, it proactively mitigates injection risks by providing templates for strict schema validation and data sanitization.
Audit Metadata