n8n Hub

Centralized n8n hub for designing reliable flows (idempotency, retries, HITL) and operating them via the public REST API. Use for planning, JSON output, and lifecycle actions like list/publish/debug.

Security Scan

The skill's functionality (design + operate n8n via its public REST API) is coherent, but the package metadata omits required environment/credential declarations and the instructions assume admin-capable API access — this mismatch and the potential for privileged API operations warrant caution.

Purpose & Capability

The name, description, and SKILL.md all consistently describe designing workflows and calling the n8n REST API (listing, publishing, retrying, debugging). That purpose matches the included endpoint index and curl examples. However, the registry metadata lists no required env vars or primary credential while the instructions repeatedly reference N8N_API_BASE_URL and N8N_API_KEY — an inconsistency between declared requirements and actual operation.

Instruction Scope

SKILL.md gives specific curl examples that will make network calls to the n8n instance and manipulate workflows, executions, users, credentials, etc. The instructions stay within the stated purpose (n8n API operations and workflow design), but they reference admin-capable endpoints (users, credentials, delete operations) and instruct the agent to use environment variables that are not declared in the skill metadata. The skill also instructs producing workflow.json and a runbook; it explicitly advises not to include secrets in runbooks (good).

Install Mechanism

This is instruction-only with no install spec and no code files to execute. That minimizes disk persistence and supply-chain risk.

Credentials

The skill's runtime instructions require an N8N_API_KEY (and optionally N8N_API_BASE_URL) to call the API, but the registry lists no required credentials. Many of the documented endpoints (create/delete users, credentials, project transfers) require admin-level privileges — the skill does not state this or declare the privilege level. Asking an agent to use a high-privilege API key without documenting it, or without offering least-privilege guidance, is disproportionate.

Persistence & Privilege

always:false and no install scripts are present. The skill does not request permanent presence or modify other skills' configs. It is not automatically forced into every agent run.

What to consider before installing

What to consider before installing: - The skill is instruction-only and would make API calls to your n8n instance using N8N_API_KEY and N8N_API_BASE_URL, but the skill metadata does not declare those required env vars — treat that as an oversight and assume the skill needs them. - Many endpoints shown (users, credentials, delete) are admin-level. Only provide an API key with the minimum privileges needed — ideally test with a staging instance or a read-only/scoped key first. - Because the skill runs network commands (curl), the agent could create, modify, or delete workflows, executions, users, or credentials if given a powerful key; confirm you trust the agent and the skill author before handing over production credentials. - Prefer using a dedicated n8n account/project with limited permissions, or rotate the API key after testing. - If you need higher assurance: ask the skill author to update registry metadata to explicitly require N8N_API_KEY/N8N_API_BASE_URL and to document the exact privilege level required; verify the skill's author/source and test on a non-production instance. Confidence notes: the assessment is medium confidence because the skill is coherent with its stated purpose, but metadata omissions and the implicit need for privileged API access create meaningful risk — additional author/source information or explicit required-env declarations would raise confidence to benign.

This skill merges two tracks:

1. Design: plan dependable workflows and optionally emit workflow.json.
2. Operate: handle workflows/executions via the public REST API.

Availability

• Public API access is disabled on free trial plans.
• An upgraded plan is required to use the API.

Configuration

Suggested environment variables (or store in .n8n-api-config):

export N8N_API_BASE_URL="https://your-instance.app.n8n.cloud/api/v1"  # or http://localhost:5678/api/v1
export N8N_API_KEY="your-api-key-here"

Create an API key at: n8n Settings → n8n API → Create an API key.

Use this skill when

• You want a workflow built for idempotency, retries, logging, and review queues.
• You need importable workflow.json plus a runbook template.
• You want to list, publish, deactivate, or debug workflows/executions via API.

Do not use when

• You need pure code automation without n8n.
• You want to bypass security controls or conceal audit trails.

Inputs

Required

• Trigger type + schedule/timezone
• Success criteria and destinations (email/Drive/DB)

Optional

• Existing workflow JSON
• Sample payloads/records
• Dedup keys

Outputs

• Default: design spec (nodes, data contracts, failure modes)
• On request: workflow.json + workflow-lab.md (from assets/workflow-lab.md)

Auth header

All requests must include:

X-N8N-API-KEY: $N8N_API_KEY

Quick actions (API)

Workflows: list

curl -s -H "X-N8N-API-KEY: $N8N_API_KEY" "$N8N_API_BASE_URL/workflows" \
  | jq '.data[] | {id, name, active}'

Workflows: details

curl -s -H "X-N8N-API-KEY: $N8N_API_KEY" "$N8N_API_BASE_URL/workflows/{id}"

Workflows: activate or deactivate

# Activate (publish)
curl -s -X POST -H "X-N8N-API-KEY: $N8N_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"versionId":"","name":"","description":""}' \
  "$N8N_API_BASE_URL/workflows/{id}/activate"

# Deactivate
curl -s -X POST -H "X-N8N-API-KEY: $N8N_API_KEY" \
  "$N8N_API_BASE_URL/workflows/{id}/deactivate"

Webhook trigger

curl -s -X POST "$N8N_API_BASE_URL/../webhook/{webhook-path}" \
  -H "Content-Type: application/json" \
  -d '{"key":"value"}'

Executions: list

curl -s -H "X-N8N-API-KEY: $N8N_API_KEY" \
  "$N8N_API_BASE_URL/executions?limit=10" \
  | jq '.data[] | {id, workflowId, status, startedAt}'

Executions: retry

curl -s -X POST -H "X-N8N-API-KEY: $N8N_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"loadWorkflow":true}' \
  "$N8N_API_BASE_URL/executions/{id}/retry"

Design workflow checklist

1. Confirm trigger type and schedule/timezone.
2. Define inputs, outputs, and validation rules.
3. Choose dedup keys to keep runs idempotent.
4. Add observability (run_id, logs, status row).
5. Add retry policy and error branches.
6. Send failures to a review queue.
7. Add guardrails to prevent silent failure.

Endpoint index

See assets/endpoints-api.md for the complete endpoint list.

Notes and tips

• The API playground is available only on self-hosted n8n and uses real data.
• The n8n API node can call the public API from within workflows.
• Webhook URLs do not require the API key header.
• Execution data can be pruned by retention settings.