Security audit

N8N QDrant workflow expert

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent RAG workflow guidance, but its examples can expose internal chats, meetings, and documents unless strong security controls are added before use.

Review this skill before installing if you plan to use it with real company data. Treat the examples as architecture sketches, not secure defaults: restrict approved sources, redact secrets and personal data before external AI calls, require authenticated webhooks and document-level filters, use least-privilege credentials, secure Qdrant and Google Drive backups, define retention/deletion handling, and pin the n8n community node version.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: docs/examples/slack-ingestion-workflow.md:69
Finding: Unredacted internal content and personal metadata are disclosed to external services
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: docs/examples/rag-agent-workflow.md:151
Finding: RAG endpoints retrieve company data without caller authentication or document-level authorization
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: docs/examples/rag-agent-workflow.md:230
Finding: Untrusted retrieved documents are inserted directly into LLM prompts
Content: View full analysis
{ const p = item.json.payload; return `[${i+1}] ${p.source_type} | ${p.source_context} | ${p.created_at?.substring(0,10)} ${p.text}`; }).join('\n\n---\n\n'); return [{ json: { query, context, source_count: results.length } }]; ``` ```json { "name": "messages", "value": "=[{ \"role\": \"system\", \"content\": \"You are a helpful assistant. Answer questions based only on the provided context. Cite sources.\" }, { \"role\": \"user\", \"content\": \"Context:\\n{{ $json.context }}\\n\\nQuestion: {{ $json.query }}\" }]" } ``` ### Technical Analysis Slack messages, meeting transcripts, emails, and documents are attacker-influenceable data. The workflow concatenates their text verbatim into an LLM message without classifying it as untrusted, escaping instruction-like content, or separating individual records through a structured data format. The system prompt only tells the model to answer from context. It does not direct the model to ignore commands found in retrieved records. In the agent pattern, the model also has access to a retrieval tool, increasing the consequences of successful instruction manipulation. ### Attack Path 1. An attacker who can write to an indexed source posts text such as instructions to ignore the system task, disclose other context, or produce attacker-selected output. 2. The ingestion workflow stores that text in Qdrant. 3. The attacker or another user submits a query designed to retrieve the poisoned record. 4. The context formatter places the malicious text directly into the LLM prompt. 5. The model interpre ...[truncated 681 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: docs/examples/rag-agent-workflow.md:181
Finding: Sensitive search queries may be sent to a sparse encoder over plaintext HTTP
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: docs/workflows/collection-setup.md:111
Finding: Full Qdrant payloads are exported to Google Drive without backup security controls
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: docs/NODE-REFERENCE.md:1
Finding: Privileged n8n community dependency is installed without version or integrity pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (18)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The markdown explains collecting payload fields such as authors, source URLs, channel/folder context, participants, and message/transcript content, which are privacy-relevant and can affect user data handling. Under the markdown-specific SQP-2 criteria, the file omits any warning or disclosure about privacy, consent, or sensitivity implications of embedding and storing this data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Slack ingestion guidance instructs users to collect channel messages and then later route content through metadata extraction, embeddings, and Qdrant storage without any privacy, consent, or data-handling warning. This is dangerous because users may unknowingly transmit internal communications, personal data, or secrets from Slack to third-party AI/embedding providers and long-term vector storage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The Fireflies transcript flow covers transcripts, participants, topics, and meeting content, then later sends normalized content into AI extraction and embedding steps, but it never warns that sensitive meeting data may leave the source system. This creates risk of exposing confidential discussions, attendee identities, and regulated information to external processors and searchable vector databases without informed review.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Google Drive workflow tells users to list, download, and extract file text, which is then fed into downstream AI and vectorization stages, but it omits any warning that document contents may be transmitted externally. This is dangerous because Drive folders often contain confidential business documents, credentials, legal material, or personal data that users may not expect to be processed by external models and persisted for retrieval.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This section explicitly instructs users to send the full document text into an Information Extractor powered by Gemini Flash or GPT-4o-mini, but it does not disclose that entire source documents are being sent to an external LLM. Because the full pre-chunked document is transmitted, the exposure can include all sensitive content in one request, increasing privacy, compliance, and data-leakage risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The embedding and upsert stages instruct users to send chunked content to OpenAI embeddings or another embedding API and then persist the resulting representations and metadata in Qdrant, but they do not warn about this external transmission and durable storage. This can lead to silent exfiltration of sensitive text and creation of a long-lived searchable corpus, expanding both breach impact and unauthorized-discovery risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation explicitly shows sending retrieved document payloads and user queries to an external re-ranking API, which can disclose internal knowledge-base contents, conversation text, and potentially sensitive metadata to a third party. In a RAG skill, this is materially risky because users may implement the pattern as written without adding consent, minimization, or vendor trust controls.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · docs/TROUBLESHOOTING.md (reported line 117)May include surrounding context.
md
- Qdrant n8n Platform Docs: https://qdrant.tech/documentation/platforms/n8n - Qdrant n8n Tutorial: https://qdrant.tech/documentation/tutorials-build-essentials/qdrant-n8n/ - n8n Qdrant Vector Store Docs: https://docs.n8n.io/integrations/builtin/cluster-nodes/root-nodes/n8n-nodes-langchain.vectorstoreqdrant - Qdrant API Reference: https://api.qdrant.tech/api-reference - n8n Self-hosted AI Starter Kit: https://github.com/n8n-io/self-hosted-ai-starter-kit - FastEmbed (sparse encoding): https://github.com/qdrant/fastembed

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example documents a RAG setup that searches Slack conversations, meeting transcripts, and documents using external LLM and embedding providers, but it does not warn that sensitive company content and user queries may be transmitted to third-party services. In a documentation-driven workflow, this omission can lead operators to deploy the pattern without understanding privacy, compliance, or data residency consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The hybrid search example sends user queries to a sparse encoder service over plain HTTP and later sends query/context to OpenAI, yet the markdown does not disclose these transmissions or their security implications. Because the context is assembled from internal knowledge-base payloads, this can expose sensitive internal data in transit or to external processors without readers realizing it.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · docs/examples/rag-agent-workflow.md (reported line 167)May include surrounding context.
md
"type": "n8n-nodes-base.httpRequest", "position": [-600, -80], "parameters": { "url": "https://api.openai.com/v1/embeddings", "method": "POST", "sendHeaders": true, "headerParameters": {

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · docs/examples/rag-agent-workflow.md (reported line 245)May include surrounding context.
md
"type": "n8n-nodes-base.httpRequest", "position": [-600, -80], "parameters": { "url": "https://api.openai.com/v1/embeddings", "method": "POST", "sendHeaders": true, "headerParameters": {

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow sends Slack message content to external OpenAI and Qdrant services, but the description and prerequisites omit any privacy, consent, or data-classification warning. In this context, Slack channels frequently contain sensitive internal discussions, credentials, customer data, or regulated information, so silently forwarding that content to third parties materially increases data exposure and compliance risk.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation explicitly states that already-ingested messages are filtered out, but the workflow shown does not implement any deduplication check before sending records to Qdrant. In an ingestion pipeline, this can cause repeated indexing of the same Slack content, leading to duplicated vectors, corrupted retrieval quality, inflated storage/costs, and downstream analysis errors.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The workflow explicitly exports full collection payloads and stores them in Google Drive, which can expose sensitive document content and metadata to a secondary storage location with different access controls, retention, and sharing settings. In a collection-management skill, this is more dangerous because vector collections often contain aggregated application data, and the instructions provide no warning, scoping, redaction, encryption, or least-privilege guidance before exfiltrating the dataset.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The document promotes targeted deletion and filtering out content before ingestion, both of which can affect retained user data and system completeness. However, the markdown does not warn readers that misconfigured identifiers, filters, or deletion criteria could remove needed records or silently omit content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The examples instruct users to send query text to external embedding and sparse-encoder APIs without noting that search terms may contain sensitive user input or proprietary business context. Although common in AI workflows, omitting any disclosure or caution can lead to unintended data exposure when operators copy the pattern directly into production.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The connections reference a Normalize Fields (passthrough) node that is not defined, which means the merge step may not actually combine original message fields with extracted metadata as intended. This is primarily an integrity and reliability issue: missing original fields can result in malformed upserts, incomplete metadata, or silent failures that undermine traceability of ingested content.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.