AI Islands
中文

npm-proxy

Developer Tools A rating

The proxy host, SSL certificate and access control of Nginx Proxy Manager are managed through REST API, which is suitable for operation and maintenance personnel to quickly configure reverse proxy and automated domain name management.

Open external ZIP download → Version：v1.0.0
OpenClaw Claude Code Cursor Codex

Usage instructions

Core usage

The npm-proxy skill realizes automated management of reverse proxy configuration by calling the REST API of Nginx Proxy Manager (NPM). User needs to configureNPM_URL、、NPM_EMAILexampleNPM_PASSWORD`Three environment variables complete identity authentication. The skill supports core operations such as listing all proxy hosts, viewing specific host details, enabling/disabling hosts, deleting hosts, and managing SSL certificates. When adding a new host, you need to call the API directly. It supports configuring domain name forwarding, SSL enforcement, WebSocket upgrade, HTTP/2 support and other advanced options, and enables Let's Encrypt automatic certificate with one click.

Significant advantages

This skill converts NPM's web interface operations into command line tools, greatly improving operation and maintenance efficiency. For scenarios that require frequent changes to agent configurations (such as CI/CD pipelines, multi-environment deployment), automated scripts instead of manual clicks can significantly reduce human errors. Pure Python standard library implementation (no third-party dependencies) reduces deployment complexity, and the local caching mechanism of JWT token (stored in/root/.npm-token.json) avoids the overhead of repeated authentication. Supported advanced functions such as HSTS, cache control, vulnerability interception, etc. meet the security needs of the production environment.

Potential Disadvantages and Limitations

There are obvious functional gaps in the current implementation: adding a new host requires using curl directly instead of encapsulated commands, the scripting function is described as "minimal", and the user experience is incomplete. The file name contains an unexpected newline character (scripts\nnpm_client.py) implies developing normative issues. Token file permissions are not set compulsorily, and there is a risk of sensitive information being leaked. Error handling is rough, printing directly to stderr and then exiting, which is not conducive to integration into more complex automated processes. In addition, skills only support NPM administrator accounts and lack role-based permission breakdown.

Suitable target group

It is mainly intended for DevOps engineers, system administrators and operation and maintenance developers, especially technical teams that have deployed NPM as a unified entry gateway. It is suitable for organizations that need to manage dozens of proxy hosts in batches, automate SSL certificate renewal, or incorporate proxy configuration into Infrastructure as Code practice. For individual developers or small-scale projects, it may be more intuitive to use NPM's web interface directly.

Risks of use

security risk: There is a risk of log leakage when passing passwords through environment variables; token files can be read by other processes if permissions are set improperly; abnormal file names may evade certain security scans.Operation and maintenance risks: Directly operating the NPM configuration of the production environment may cause service interruption; there is a lack of operation confirmation mechanism, and it is difficult to recover if the host is accidentally deleted.Dependence risk: Skills are bound to a specific NPM version, and API changes may cause function failure; a stable network connection to the NPM instance is required.Compliance risk: Let's Encrypt certificate applications are subject to rate limits, and batch operations may trigger bans.

Safety review

Core usage

npm-proxyIt is an API client skill for Nginx Proxy Manager (NPM) that allows users to manage reverse proxy hosts, SSL certificates, and access control lists through the command line. Key features include:

  • Agent host management: List, enable/disable, delete proxy hosts
  • SSL certificate management: View certificate list, supports Let's Encrypt automatic renewal
  • Domain name configuration: Add a new domain name to point to the internal server port and support HTTP/HTTPS forwarding
  • Advanced options: WebSocket upgrade, HTTP/2 support, caching, HSTS, etc.

Significant advantages

  • Zero dependency security: Only uses Python standard libraries (urllib, json), no third-party package dependencies, completely avoiding the risk of supply chain attacks
  • Credential management specifications: Sensitive information (email, password) is read from environment variables, in line with security best practices
  • Lightweight and efficient: 124 lines of core code, focused functions, low audit cost
  • Self-hosted friendly: Designed specifically for private NPM instances, where the data is fully controlled by the user

Potential Disadvantages and Limitations

  • Limited functionality: To create a new host, you need to use curl directly. The client script only implements basic query/switch operations.
  • Token plain text cache: API Token is stored in plain text in JSON format in~/.npm-token.json, there is a risk of local file permissions
  • No HTTPS mandatory verification: The code does not verify the NPM_URL protocol and may misuse HTTP to leak credentials.
  • Poor error handling: General Exception capture, imperfect processing of network timeout scenarios
  • Personal developer maintenance: Source credibility T3, no organizational endorsement, uncertainty in long-term updates

Suitable for the crowd

  • Self-hosted users with Nginx Proxy Manager deployed
  • DevOps/operations engineers who need to automate the management of reverse proxies
  • Technology enthusiasts who are familiar with the Docker/Homelab environment
  • Cautious users who value supply chain security and are willing to review code

General risks

1. man-in-the-middle attack: If NPM_URL is configured incorrectly or forced HTTPS does not take effect, the credential transmission may be intercepted
2. Local privilege escalation: The default permissions of the Token file are loose and may be read by other processes in a multi-user system.
3. NPM instance security: Skill security completely relies on the configuration and protection of the back-end NPM server.
4. Function misuse: Advanced configuration (advanced_config) directly transparently transmits Nginx configuration. Syntax errors may cause service failures.

Usage suggestions

It is recommended to manually add HTTPS mandatory checksum and Token file 600 permission settings before deployment, and regularly check the update status of NPM instances and Skills.

devopsbackendautomationapinetworking

Copyright and takedown notice: AI Islands curates this page from public information. Skills, code, documents and packages remain the property of their original authors or rights holders. This listing is provided for indexing, research and installation convenience. If you believe any listing or download link infringes your rights, contact ai-islands@streamflowintel.com with proof of ownership, relevant URLs and your request. We will review and remove or adjust the content promptly. Review package permissions, dependencies and safety risks before installing.

Related Agent Skills