n8n工作流管理

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:27 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent n8n workflow-management helper, but it grants broad workflow-changing authority through a bearer token without enough safety guidance.

Review this skill before installing. Only use it with an n8n MCP token you are willing to grant workflow-management authority to, store that token as a secret, and confirm before creating, publishing, executing, updating, or archiving workflows because those actions can persistently change your automation environment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill describes use of an Authorization bearer token and tells the user to obtain and configure it, but does not warn that the token is a sensitive credential that grants control over local n8n workflows. If exposed in prompts, logs, shell history, or copied examples, the token could be reused to create, execute, publish, or delete workflow-related assets.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs users to publish, execute, update, and archive workflows, all of which can alter local automation behavior and stored workflow state, but it does not warn that these are state-changing operations. In this context, workflows may trigger network calls, scheduled jobs, or modify business logic on the host n8n instance, so omission of a clear warning increases the risk of unintended operational changes.

External Transmission

Medium

• Category: Data Exfiltration

Content

## 调用格式（curl）
```bash
TOKEN="<n8n-mcp-token>"
curl -s -X POST http://localhost:5678/mcp-server/http \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"<TOOL>","arguments":{...}}}'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The natural-language instructions throughout the skill are presented only in Chinese, which can impose a language constraint on users without opt-in. The file does not indicate that the language choice is optional or required for a justified region-specific reason.

Static analysis

No suspicious patterns detected.