ConnectWise Automate

It requires CW_AUTOMATE_SERVER_URL, CLIENT_ID, username, password, and a 2FA code, which are highly sensitive credentials; if exposed, they could be used to access or operate the ConnectWise Automate tenant. However, the materials do not show these credentials being sent to unrelated third parties.

Although no fixed remote host is listed, the SERVER_URL indicates it will connect to a user-configured ConnectWise Automate server and transmit management data related to computers, clients, alerts, and scripts. This is normal network behavior for an RMM integration, and there is no evidence here of exfiltration to unknown endpoints.

The system flags it as executes-code, and the description explicitly mentions scripts, indicating the tool can execute scripts/code. This is a normal but high-impact capability in an RMM context; it should be tightly scoped and carefully authorized, but this alone is not enough to classify it as high risk.

Per the description, it can access computers, clients, alerts, and scripts in ConnectWise Automate, implying exposure to device inventories, client information, alerts, and automation scripts. The materials do not show additional local filesystem access or clear signs of permissions exceeding its stated purpose.

It comes from an official registry, has publicly auditable source code, and was updated within the last year; these are positive indicators that reduce supply-chain risk. Although the repository does not declare a license and has very low star count, code review and dependency pinning are still advisable before deployment, and no clear supply-chain red flags are evident from the materials.