n8n Hub

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:54 AM UTC
• Version: 1.0.0

Overview

This n8n skill is mostly documentation, but it teaches broad live API operations with a powerful API key without enough guardrails, so it should be reviewed before use.

Install only if you are comfortable letting an agent help operate n8n through a real API key. Use a least-privilege key, prefer environment injection or a secret manager over a local config file, avoid production webhook and retry tests unless side effects are understood, and require explicit confirmation before delete, role-change, credential, activation, deactivation, source-control, or bulk data operations.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:19
• Finding: Plaintext Storage Recommendation for a Privileged n8n API Key## Vulnerability Details **File Location**: `SKILL.md`, lines 19-24 **Vulnerability Type**: Plaintext sensitive-data storage **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash Suggested environment variables (or store in `.n8n-api-config`): export N8N_API_BASE_URL="https://your-instance.app.n8n.cloud/api/v1" # or http://localhost:5678/api/v1 export N8N_API_KEY="your-api-key-here" ``` ### Technical Analysis The documentation recommends storing the n8n API key in a local `.n8n-api-config` file but does not require restrictive file permissions, version-control exclusion, encryption, or secret-manager integration. This creates a risk that a privileged credential will remain in plaintext and become accessible through repository commits, backups, shared workspaces, filesystem access, or diagnostic archives. The key is used as the `X-N8N-API-KEY` authentication value for the n8n public API. The documented API surface includes administrative and destructive operations involving workflows, executions, credentials, users, projects, variables, and data tables. The exact privileges available to an attacker depend on the permissions assigned to the exposed key. The alternative example permits an `http://localhost` base URL. While appropriate in some isolated local deployments, plaintext HTTP should not be recommended for remote or untrusted network paths because the API key could be intercepted in transit. ### Attack Path 1. A user follows the recommendation and writes a valid n8n API key to `.n8n-api-config`. 2. The file is created with permissive filesystem permissions, included in a repository commit, copied into a backup, or exposed through a shared workspace. 3. An attacker with access to that location retrieves the plaintext API key and configured n8n base URL. 4. The attacker submits requests containing the stolen key in the `X-N8N-API-KEY` header. 5. Subject to the key's assigned permissions, the attacker reads ...[truncated 991 chars]
• Remediation: ## Remediation Suggestions - Remove the general recommendation to store API keys in `.n8n-api-config`; prefer a managed secret store or runtime secret injection. - If file-based storage is unavoidable, explicitly require permissions of `0600` and ensure that only the intended account owns the file. - Add `.n8n-api-config` to `.gitignore` and equivalent exclusions for backup, packaging, container-build, and diagnostic processes. - Never commit a real API key, include it in generated workflow artifacts, or print it in logs and command output. - Use dedicated, least-privilege API keys and rotate them periodically and immediately after suspected exposure. - Require HTTPS with certificate validation for non-loopback connections. Restrict plaintext HTTP examples to explicitly isolated loopback-only development environments. - Avoid loading configuration files as arbitrary shell scripts. Parse a strict key-value format so tampered configuration cannot introduce shell commands. - Document revocation and incident-response procedures for exposed keys.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Instruction Override

High

• Category: Prompt Injection

Content

## Do not use when
- You need pure code automation without n8n.
- You want to bypass security controls or conceal audit trails.

## Inputs
**Required**

• Confidence: 90% confidence
• Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Workflows: details
```bash
curl -s -H "X-N8N-API-KEY: $N8N_API_KEY" "$N8N_API_BASE_URL/workflows/{id}"
```

### Workflows: activate or deactivate

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill documents state-changing workflow operations like activate/deactivate without any caution about operational consequences, authorization checks, or change-control expectations. In an agentic context, this increases the chance that a user or automated system will trigger production changes unintentionally, causing outages or unexpected workflow execution.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The execution retry example omits a warning that retrying a prior execution may re-run side-effecting actions such as emails, database writes, or third-party API calls. In workflow systems, this can cause duplicate processing, financial impact, or inconsistent state if idempotency is not enforced.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Executions: retry
```bash
curl -s -X POST -H "X-N8N-API-KEY: $N8N_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"loadWorkflow":true}' \
  "$N8N_API_BASE_URL/executions/{id}/retry"

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This markdown file documents operations such as deleting users, workflows, credentials, variables, projects, and rows, as well as changing roles and pulling source control changes, but it does not include any warning about data loss, privilege changes, or operational impact. Under the markdown-specific SQP-2 criteria, a skill description should warn when described behaviors could affect user data, privacy, or system integrity.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The webhook example shows how to send data to a live endpoint but does not warn that it may invoke real automation, trigger side effects, or process sensitive input immediately. This omission can lead users or agents to test against production webhooks unsafely.

Static analysis

No suspicious patterns detected.