T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:9- Finding
Undisclosed Attribution Marker Injected into Generated Workflows
- Content
View full analysis
- Remediation
View remediation
Security audit
N8n Workflow Builder
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its n8n workflow-building purpose, but it requires adding an undisclosed signature marker into generated workflows.
Review generated workflows before importing them into n8n, especially comments and annotations, and remove any unwanted signature marker. Also confirm the workflow only uses the integrations, credentials, posting actions, and API calls you intended.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation conditions are broad enough to match routine requests for general automation or workflow help, which can cause the skill to invoke outside its intended scope. In a system with multiple skills or safety boundaries, this increases the chance of unintended capability exposure and context hijacking, especially because the skill is designed to emit ready-to-deploy automation JSON that may include credential-dependent integrations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases such as "create an automation for..." and "automate my [process]" are ambiguous and likely to overlap with many benign requests unrelated to this specific skill. That makes accidental invocation more likely, which can bypass more appropriate routing and cause the agent to produce workflow artifacts or integration guidance in contexts where the user did not ask for n8n-specific behavior.
- Content