ClawHub
Back to skill

Security audit

n8n Hub

Security checks for vulnerabilities and agentic risk

Overview

This n8n skill is mostly documentation, but it teaches broad live API operations with a powerful API key without enough guardrails, so it should be reviewed before use.

Install only if you are comfortable letting an agent help operate n8n through a real API key. Use a least-privilege key, prefer environment injection or a secret manager over a local config file, avoid production webhook and retry tests unless side effects are understood, and require explicit confirmation before delete, role-change, credential, activation, deactivation, source-control, or bulk data operations.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:19
Finding

Plaintext Storage Recommendation for a Privileged n8n API Key

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19-24
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: Medium

Vulnerable Code Snippet:

bash
Suggested environment variables (or store in `.n8n-api-config`):

export N8N_API_BASE_URL="https://your-instance.app.n8n.cloud/api/v1"  # or http://localhost:5678/api/v1
export N8N_API_KEY="your-api-key-here"

Technical Analysis

The documentation recommends storing the n8n API key in a local .n8n-api-config file but does not require restrictive file permissions, version-control exclusion, encryption, or secret-manager integration. This creates a risk that a privileged credential will remain in plaintext and become accessible through repository commits, backups, shared workspaces, filesystem access, or diagnostic archives.

The key is used as the X-N8N-API-KEY authentication value for the n8n public API. The documented API surface includes administrative and destructive operations involving workflows, executions, credentials, users, projects, variables, and data tables. The exact privileges available to an attacker depend on the permissions assigned to the exposed key.

The alternative example permits an http://localhost base URL. While appropriate in some isolated local deployments, plaintext HTTP should not be recommended for remote or untrusted network paths because the API key could be intercepted in transit.

Attack Path

  1. A user follows the recommendation and writes a valid n8n API key to .n8n-api-config.
  2. The file is created with permissive filesystem permissions, included in a repository commit, copied into a backup, or exposed through a shared workspace.
  3. An attacker with access to that location retrieves the plaintext API key and configured n8n base URL.
  4. The attacker submits requests containing the stolen key in the X-N8N-API-KEY header.
  5. Subject to the key's assigned permissions, the attacker reads ...[truncated 991 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the general recommendation to store API keys in .n8n-api-config; prefer a managed secret store or runtime secret injection.
  • If file-based storage is unavoidable, explicitly require permissions of 0600 and ensure that only the intended account owns the file.
  • Add .n8n-api-config to .gitignore and equivalent exclusions for backup, packaging, container-build, and diagnostic processes.
  • Never commit a real API key, include it in generated workflow artifacts, or print it in logs and command output.
  • Use dedicated, least-privilege API keys and rotate them periodically and immediately after suspected exposure.
  • Require HTTPS with certificate validation for non-loopback connections. Restrict plaintext HTTP examples to explicitly isolated loopback-only development environments.
  • Avoid loading configuration files as arbitrary shell scripts. Parse a strict key-value format so tampered configuration cannot introduce shell commands.
  • Document revocation and incident-response procedures for exposed keys.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Instruction Override

High
Category
Prompt Injection
Confidence
90% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md
## Do not use when
- You need pure code automation without n8n.
- You want to bypass security controls or conceal audit trails.

## Inputs
**Required**

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

Workflows: details

bash
curl -s -H "X-N8N-API-KEY: $N8N_API_KEY" "$N8N_API_BASE_URL/workflows/{id}"

Workflows: activate or deactivate

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill documents state-changing workflow operations like activate/deactivate without any caution about operational consequences, authorization checks, or change-control expectations. In an agentic context, this increases the chance that a user or automated system will trigger production changes unintentionally, causing outages or unexpected workflow execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The execution retry example omits a warning that retrying a prior execution may re-run side-effecting actions such as emails, database writes, or third-party API calls. In workflow systems, this can cause duplicate processing, financial impact, or inconsistent state if idempotency is not enforced.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

Executions: retry

bash
curl -s -X POST -H "X-N8N-API-KEY: $N8N_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"loadWorkflow":true}' \
  "$N8N_API_BASE_URL/executions/{id}/retry"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file documents operations such as deleting users, workflows, credentials, variables, projects, and rows, as well as changing roles and pulling source control changes, but it does not include any warning about data loss, privilege changes, or operational impact. Under the markdown-specific SQP-2 criteria, a skill description should warn when described behaviors could affect user data, privacy, or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The webhook example shows how to send data to a live endpoint but does not warn that it may invoke real automation, trigger side effects, or process sensitive input immediately. This omission can lead users or agents to test against production webhooks unsafely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.