Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add znlgis/opengis-skills --skill node-redgit clone --depth 1 https://github.com/znlgis/opengis-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/znlgis/opengis-skills/node-red)<a href="https://agentmods.dev/skills/znlgis/opengis-skills/node-red"><img src="https://agentmods.dev/badge/skills/znlgis/opengis-skills/node-red/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/znlgis/opengis-skills/node-red"><img src="https://agentmods.dev/badge/skills/znlgis/opengis-skills/node-red.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.04749 |
| Opus 5.5 | $0.00026 | $0.01900 |
| Sonnet 5.5 | $0.00013 | $0.00950 |
| Haiku 4.5 | $0.00007 | $0.00475 |
Grade B, and why
node-red scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
| `npm install -g node-red` 报权限错误 | Linux/macOS 用 `sudo npm install -g --unsafe-perm node-red`;Windows 去掉 `sudo`;或改用 Docker | How it starts
The opening of the file, as written. The whole thing — 364 lines — stays where its author put it; the contents beside it link to each section on GitHub.
项目地址: https://github.com/node-red/node-red
官方文档: https://nodered.org/docs/
许可证: Apache-2.0
概述
Node-RED 是构建在 Node.js 之上的低代码事件驱动编程工具,用于把设备、API 和在线服务以「连线」的方式编排成数据流。它最初由 IBM 新兴技术团队发起,现为 OpenJS Foundation 项目,最新版本 5.0.8。运行时以「消息在节点之间传递」为核心模型:每个节点接收一个 JavaScript 对象 msg,处理后交给下一个节点。流(flow)在浏览器中的编辑器里以拖拽方式搭建,保存为 JSON(默认 flows_<hostname>.json)。
关键概念:
- 节点(node):流的处理单元,分为输入(inject、mqtt in、http in)、处理(function、change、switch、json)、输出(debug、mqtt out、http response)三类
- 消息(msg):在节点间传递的 JavaScript 对象,约定使用
msg.payload承载数据,运行时自动附加_msgid用于追踪 - 流(flow)/ 标签页(tab):一组连线的节点,同一标签页共享 flow 级上下文
- 子流程(subflow):把一组节点折叠成一个可复用节点,暴露属性为环境变量
- 上下文(context):节点级 / flow 级 / global 级三层状态存储
- 面板(dashboard):通过
node-red-dashboard等包把消息渲染成图表、仪表盘等 UI
环境准备
要求 Node.js 已安装(受支持的 LTS 版本)。
方式一:npm 全局安装
# 全局安装 Node-RED(Windows 去掉 sudo)
npm install -g --unsafe-perm node-red
# 启动,默认监听 1880 端口
node-red
方式二:Docker
# 镜像名为 nodered/node-red(1.0 起),映射 1880 端口并持久化 /data
docker run -it -p 1880:1880 -v node_red_data:/data --name mynodered nodered/node-red
docker-compose.yml 参考:
version: "3.7"
services:
node-red:
image: nodered/node-red:latest
environment:
- TZ=Asia/Shanghai
ports:
- "1880:1880"
volumes:
- node-red-data:/data
volumes:
node-red-data:
验证
启动后浏览器访问编辑器:http://localhost:1880
默认目录与文件:用户目录 ~/.node-red,流文件 flows_<hostname>.json,配置文件 settings.js。停止服务用 Ctrl-C。
核心 API / 命令
消息对象 msg
| 属性 | 含义 |
|---|---|
msg.payload |
节点默认操作的数据主体,可为任意 JS 类型(String/Number/Boolean/Array/Object/Buffer/Null) |
msg.topic |
主题标识,MQTT 节点默认用它作为发布/订阅主题 |
msg._msgid |
运行时自动添加的消息追踪 ID |
msg.parts |
消息序列元数据(id/index/count),由 split、join、batch 等节点维护 |
对象类型属性用点路径访问,例如 payload.Phone[2].type。JSON 字符串需先用 JSON 节点解析后才能访问其内部字段。
核心节点速查
| 节点 | 类型 | 说明与关键属性 |
|---|---|---|
inject |
输入 | 手动点击或按间隔自动触发;可设置任意消息属性,payload 支持字符串/数字/布尔/JSON/时间戳/上下文值;最大间隔 596 小时 |
debug |
输出 | 在调试侧栏结构化展示消息,可切换输出到运行时日志或节点状态文本(32 字符) |
function |
处理 | 对消息执行 JavaScript 代码 |
change |
处理 | 无需写代码修改消息/上下文属性;操作按 Set、Change、Move、Delete 顺序执行,值支持 JSONata 表达式 |
switch |
处理 | 按规则(值、序列、JSONata、Otherwise)把消息路由到不同输出;可匹配多个输出或首个匹配即停 |
template |
处理 | 用 Mustache 语法生成文本,结果若为合法 JSON/YAML 可解析为对象 |
mqtt in |
输入 | 订阅主题,输出消息 |
mqtt out |
输出 | 发布消息到主题 |
http in |
输入 | 暴露 HTTP 端点,生成 msg.req/msg.res |
http response |
输出 | 用 msg.payload 作为响应体返回 |
http request |
处理 | 主动发起 HTTP 请求 |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 364 lines · 66 tokens per session scan B ef8505256c93
node-red is a skill published in the GitHub repository znlgis/opengis-skills (64 stars, last pushed yesterday), licensed MIT. It adds 66 tokens to every session and 4,749 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-16.
Other skills, from other repositories
industrial-iot
Architect high-throughput industrial telemetry via MQTT & OPC UA.
amazon-alexa
Integracao completa com Amazon Alexa para criar skills de voz inteligentes, transformar Alexa em assistente com Claude como cerebro (projeto Auri) e integrar com AWS ecosystem (Lambda, DynamoDB, Polly, Transcribe, Lex, Smart Home).
amazon-alexa
Integracao completa com Amazon Alexa para criar skills de voz inteligentes, transformar Alexa em assistente com Claude como cerebro (projeto Auri) e integrar com AWS ecosystem (Lambda, DynamoDB, Polly, Transcribe, Lex, Smart Home).
iot-expert
Expert-level IoT systems, embedded devices, edge computing, and IoT protocols. Use when the user mentions embedded, edge computing, MQTT, sensors, or firmware, or when the task involves IoT Architecture, IoT Protocols, Embedded Systems, or Device Design.
acme-cse
Answer questions about the ACME oneM2M CSE open source project — installation, configuration, runtime options, protocol bindings, plugins, scripting, and development. Use this skill whenever the user asks anything about ACME CSE, oneM2M, acmecse, acme.ini, CSE setup, or running/configuring the ACME middleware, even if…
aether-iot-query
Use this skill when the user asks about a live AetherEdge runtime: channels, points, real-time values, history, alarms, rules, models, instances, routing, SHM health, service health, or system status. Use aether CLI commands to answer — do NOT inspect source code, local database files, or config YAMLs to answer…