Haresh Cart Management

Manage shopping cart operations via n8n webhook integration

Security Scan

The skill's requested actions and runtime instructions are consistent with a cart-management integration that posts to local n8n webhooks, but the instructions are underspecified in places (how to validate product IDs and obtain current cart state) and you should verify webhook placement and authentication before enabling it.

Purpose & Capability

Name/description claim shopping-cart operations via n8n webhooks and the SKILL.md only references calling local n8n webhook endpoints (http://localhost:5678/webhook/...). No unrelated binaries, env vars, or install steps are requested, so required resources are proportionate to the stated purpose.

Instruction Scope

Runtime instructions are limited to extracting product_id/quantity and calling the three localhost webhook endpoints. However, they do not specify how to 'validate product_id exists' or how to 'check current quantity' (e.g., which API or data source to use), which is ambiguous and could lead the agent to probe other services for context. Otherwise the instructions do not direct reading files or exfiltrating data.

Install Mechanism

Instruction-only skill with no install spec and no code files — nothing is written to disk or downloaded. This is the lowest-risk install profile.

Credentials

No environment variables, credentials, or config paths are requested, which is proportionate for a webhook-based cart skill. The use of localhost endpoints means no external credentials are declared, but those endpoints may rely on local n8n auth which is not described.

Persistence & Privilege

Skill is not always-enabled and does not request persistent privileges or modifications to other skills. Default autonomous invocation is allowed (platform default) but not combined with other concerning flags.

Assessment

This skill looks coherent with its purpose, but it leaves important details unspecified. Before installing: (1) Ensure you actually run n8n at http://localhost:5678 and that the three webhook endpoints exist and are authenticated — otherwise the agent will attempt local HTTP requests that could be abused. (2) Confirm how product_id validation and current-cart checks are implemented (does your n8n workflow perform these checks?), and avoid giving the agent blanket access to external/internal services you don't control. (3) Prefer protecting the webhooks with authentication or a secret token and document expected request/response formats. If you need stronger assurance, run the skill in a sandboxed agent or review/modify the SKILL.md to explicitly call authenticated endpoints and to define where validation and cart-state reads occur.

Cart Management Skill

Purpose

Handles all shopping cart operations including adding items, removing items, and updating quantities.

When to Use

• User wants to add a product to their cart
• User wants to remove an item from cart
• User wants to change item quantity

Supported Actions

Add to Cart

1. Extract product_id from user message
2. Validate product_id format
3. Check quantity (default to 1)
4. Call n8n webhook at http://localhost:5678/webhook/cart-add
5. Confirm success to user

Remove from Cart

1. Extract product_id to remove
2. Check current quantity
3. If quantity greater than 1, ask user for confirmation
4. Call n8n webhook at http://localhost:5678/webhook/cart-remove
5. ALWAYS confirm with user before removing

Update Quantity

1. Extract product_id and new quantity
2. Validate quantity is positive integer
3. Call n8n webhook at http://localhost:5678/webhook/cart-update
4. Confirm update to user

Safety Rules

• NEVER allow negative quantities
• ALWAYS confirm before removing items
• Validate product_id exists before operations