T08 · Insecure Dependencies
Warning
- Location
README.md:25- Finding
Unpinned Third-Party Package Execution Through npx
- Content
View full analysis
- Remediation
View remediation
Security audit
N8n Openclaw Bridge
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it says, but it gives an agent broad live n8n automation control with weak guardrails around credentials, destructive actions, and exposed webhooks.
Install only if you are comfortable letting an agent operate your n8n instance. Use a scoped API key, avoid storing secrets in broadly readable files, pin the package version, require human confirmation for delete, activate, deactivate, retry, and production webhook triggers, and add authentication plus schema validation to the included webhook templates before exposing them.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
templates/content-publisher.json:4- Finding
Unauthenticated Content-Publishing Webhook Permits Notification Injection
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
templates/lead-notification.json:4- Finding
Unauthenticated Lead Webhook Allows Personal-Data Injection Into Downstream Integrations
- Content
View full analysis
- Remediation
View remediation
other
Note
- Location
templates/content-publisher.json:30- Finding
Content Workflow Reports Publication Success Without Performing or Verifying Publication
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 88% confidence
- Finding
The README instructs users to install the skill via an unpinned
npx skills add n8n-openclaw-bridge -g, which can pull the latest package state without version immutability. That increases supply-chain risk because a compromised or later-malicious package update could be installed implicitly, especially for a skill that enables shell-enabled remote automation and credentialed access to an n8n instance.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README tells users to add an n8n URL and API key to
TOOLS.mdand promotes remote workflow control, but it does not warn about secure credential storage, least-privilege API keys, or the consequences of letting an agent perform external automations. In this context, missing warnings are especially dangerous because the skill is explicitly designed to bridge an agent with 800+ integrations and can amplify credential misuse into broad downstream actions.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The invocation guidance is broad and action-oriented (e.g. 'List my n8n workflows' or 'Create an automation for...') without clear activation boundaries, approval requirements, or task-scoping constraints. In a skill that can create, trigger, and manage remote workflows, this can cause over-broad activation and unsafe autonomous actions against connected services.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad enough to activate on common requests like 'create a workflow' or 'automate this process,' which can cause the agent to enter a high-impact automation skill without clear user intent or confirmation. In this skill, that is more dangerous because the skill enables workflow creation, activation, deletion, and webhook triggering against an external automation platform.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill documents destructive and externally impactful operations such as activating, deactivating, deleting workflows, and triggering remote automation, but does not warn that these actions can change live systems, send data externally, or cause side effects in connected services. In context, this omission materially increases risk because n8n can fan out into email, CRM, publishing, and other downstream actions, so a mistaken invocation may have broad real-world impact.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
This example performs authenticated state-changing requests to an external n8n instance to activate or deactivate workflows. While normal for the skill's purpose, it is security-relevant because it enables remote operational changes that could disable safeguards, enable unsafe workflows, or alter production behavior if invoked without strict intent validation and confirmation.
- Content
Activate/Deactivate Workflow
bash # Activate curl -s -X PATCH -H "X-N8N-API-KEY: $N8N_API_KEY" -H "Content-Type: application/json" \ -d '{"active": true}' "$N8N_API_URL/api/v1/workflows/{id}" # Deactivate
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
Retrying failed executions sends an authenticated external request that can re-run prior automation with real side effects, including duplicate API calls, messages, or transactions. In this context, retries are especially risky because n8n workflows may perform non-idempotent actions across third-party systems.
- Content
Retry Failed Execution
bash curl -s -X POST -H "X-N8N-API-KEY: $N8N_API_KEY" \ "$N8N_API_URL/api/v1/executions/{id}/retry"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The quick-reference webhook trigger example sends arbitrary payloads to an external automation endpoint, which can directly launch workflows with downstream effects in connected systems. This is more dangerous in this skill because webhook execution is presented as a simple default operation, yet it may initiate publishing, CRM updates, notifications, or other irreversible actions.
- Content
md curl -s -H "X-N8N-API-KEY: $KEY" "$N8N_API_URL/api/v1/workflows" | jq '.data[] | .name' # Trigger webhook curl -s -X POST "$N8N_API_URL/webhook/[path]" -H "Content-Type: application/json" -d '{...}' # Check failed executions curl -s -H "X-N8N-API-KEY: $KEY" "$N8N_API_URL/api/v1/executions?status=error&limit=5"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The workflow exposes a POST webhook that accepts arbitrary content and immediately routes it into a publication/notification flow without any visible authentication, authorization, signature verification, or human confirmation step. In this context, an attacker who can reach the webhook could trigger unauthorized publishing actions or spam downstream notification channels, making the absence of approval and access controls materially risky rather than merely a usability issue.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This workflow forwards lead PII and business contact data from an inbound webhook to Telegram and an external Google Sheets webhook with no validation, minimization, consent check, or disclosure visible in the skill. That creates a real data-handling risk: sensitive lead information can be propagated to third-party services, increasing exposure, retention, and accidental leakage if those destinations are misconfigured or unauthorized.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This workflow exfiltrates monitoring data to an external Telegram destination using environment-provided chat identifiers, but the template provides no in-band warning, consent step, or configuration guidance about that outbound transmission. In context, the data sent is limited to URL, status, body-size delta, and timestamp, so the risk is moderate rather than high, but it still creates a real confidentiality and governance concern if users monitor internal or sensitive endpoints.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This is a manifest-like JSON file, so vague trigger analysis applies. The path "new-lead" is somewhat generic and the file provides no additional constraints, exclusions, or contextual limits on what qualifies as a lead submission, making the activation scope underspecified.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This is a JSON manifest/template file, so vague-trigger checks apply. The name "Agent: Website Monitor" describes a broad capability but does not specify any trigger phrases, scope constraints, or exclusion conditions, which could make activation matching overly permissive in systems that infer invocation from manifest text.
- Content
Static analysis
No suspicious patterns detected.