T09 · Insecure Skill Coding Practices
Error
- Location
scripts/n8n-api.sh:6- Finding
API Key Can Be Transmitted to an Unrestricted or Cleartext Endpoint
- Content
View full analysis
Vulnerability Details
File Location:
scripts/n8n-api.sh, lines 6–14 and 37–72
Vulnerability Type: Unvalidated destination for privileged API credentials
Risk Level: HighVulnerable Code
bash N8N_URL="${N8N_URL:-http://localhost:5678}" N8N_API_KEY="${N8N_API_KEY:-}" if [ -z "$N8N_API_KEY" ]; then echo "ERROR: N8N_API_KEY not set" >&2; exit 1 fi AUTH_HEADER="X-N8N-API-KEY: $N8N_API_KEY" BASE="$N8N_URL/api/v1"The credential-bearing header and unvalidated base URL are then used by every supported operation:
bash case "${1:-}" in list) curl -s -H "$AUTH_HEADER" "$BASE/workflows" | jq . ;; get) curl -s -H "$AUTH_HEADER" "$BASE/workflows/$2" | jq . ;; create) curl -s -X POST -H "$AUTH_HEADER" -H "Content-Type: application/json" \ -d @"$2" "$BASE/workflows" | jq . ;; create-stdin) curl -s -X POST -H "$AUTH_HEADER" -H "Content-Type: application/json" \ -d @- "$BASE/workflows" | jq . ;; update) curl -s -X PUT -H "$AUTH_HEADER" -H "Content-Type: application/json" \ -d @"$3" "$BASE/workflows/$2" | jq . ;; activate) curl -s -X POST -H "$AUTH_HEADER" -H "Content-Type: application/json" \ -d '{"active": true}' "$BASE/workflows/$2/activate" | jq . ;; deactivate) curl -s -X POST -H "$AUTH_HEADER" -H "Content-Type: application/json" \ -d '{"active": false}' "$BASE/workflows/$2/deactivate" | jq . ;; delete) curl -s -X DELETE -H "$AUTH_HEADER" "$BASE/workflows/$2" | jq . ;; execute) curl -s -X POST -H "$AUTH_HEADER" "$BASE/workflows/$2/run" | jq . ;; tags) curl -s -H "$AUTH_HEADER" "$BASE/tags" | jq . ;; credentials) curl -s -H "$AUTH_HEADER" "$BASE/credentials" | jq . ;; esacTechnical Analysis
N8N_URLis read directly from the environment and used as the destination for request ...[truncated 2410 chars]- Remediation
View remediation
Remediation Suggestions
- Parse and validate
N8N_URLbefore constructing any authenticated request. - Require
https://for all non-loopback destinations. Permithttp://only for explicit loopback hosts such aslocalhost,127.0.0.1, or[::1]. - Reject malformed URLs, embedded credentials, unexpected schemes, fragments, and unapproved ports.
- Where deployment topology permits, enforce an explicit hostname or origin allowlist for the intended n8n instance.
- Configure curl to reject protocol downgrades and fail reliably, for example with
--fail-with-body,--show-error, and--proto '=https'for remote endpoints. - Avoid automatically following redirects. If redirects are ever enabled, ensure the API key cannot be forwarded to a different origin.
- Use an n8n API key restricted to only the operations required by the Skill rather than a workspace-wide administrative credential.
- Store the key in an appropriately protected secret store, rotate it after suspected disclosure, and avoid exposing the process environment to untrusted users.
- Consider pinning a private certificate authority or server certificate where the n8n instance uses an internal PKI.
- Add automated tests confirming that arbitrary hosts, cleartext remote URLs, and malformed destinations are rejected before any credential-bearing request is made.
- Parse and validate