Homeassistant N8n Agent

• Analyzed: May 14, 2026, 3:19 AM
• Findings: 1
• Version: 1.0.4
• Hash: a3e96a679de64bee97e035ff488446ec8eab4e2d906f15fe0287d1a789412137
• Source: palm
• External report: View on VirusTotal

Findings (1)

The SKILL.md instructs the OpenClaw agent to construct a `curl` command where user input (`USERS QUESTION/REQUEST`) is directly embedded into the JSON payload. This creates a severe prompt injection vulnerability, potentially leading to shell injection or JSON injection if the agent does not properly sanitize or escape the user's input before executing the `curl` command. While the intended target is `localhost:5678` (a local n8n instance), this vulnerability could allow an attacker to execute arbitrary commands on the local system where the agent is running, making it a significant security risk.