N8n Workflow Automation 1.0.0

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: n8n-workflow-automation-1-0-0 Version: 1.0.0 The skill is designed to assist in creating secure and auditable n8n workflows. The `SKILL.md` explicitly instructs the AI agent to adhere to security best practices, such as not bypassing security controls, not hiding audit trails, avoiding secrets in output (referencing environment variables instead), preferring least privilege, and stopping to ask the user for clarification on credential strategies or privileged access. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or harmful prompt injection attempts. All instructions align with the stated purpose of designing robust automation.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If a user activates a generated workflow without review, it could send emails or write records to connected services.

Why it was flagged

Generated n8n workflows may write to external systems after a user imports and activates them. This is purpose-aligned and bounded by safeguards such as explicit JSON requests, inactive workflows, and credential review.

Skill content
Targets: where to write results (email/Drive/Sheet/DB) and required fields.
Recommendation

Review all generated nodes, destinations, credential names, and scopes before importing or activating the workflow in n8n.

What this means

This does not show unsafe behavior, but it makes provenance slightly less tidy for users who rely on owner or slug metadata.

Why it was flagged

The registry metadata in the prompt lists a different owner ID and a versioned slug, so the packaged _meta.json is not fully consistent with the registry metadata.

Skill content
"ownerId": "kn7crzxy2455jgg7b1swy21gtn7zd7c2", "slug": "n8n-workflow-automation"
Recommendation

Verify the publisher/source if provenance matters before installing, especially because the source and homepage are not provided.