N8n Automation Secure

• Risk level: Low
• Analyzed: Apr 9, 2026, 8:56 AM
• Findings: 0
• Version: 1.0.0

Overview

The skill's requested resources and runtime instructions are consistent with an n8n integration: it only asks for N8N_URL and N8N_API_KEY, uses curl-style API calls, and provides a local validation script and audit logging — nothing obvious is disproportionate to the stated purpose.

This skill appears coherent for integrating with n8n, but take these precautions before installing or running it: 1) Inspect scripts/validate-setup.sh (and any executable in the repo) to confirm it only checks env vars, connectivity, and creates log directories as documented. 2) Run validation in an isolated/test environment first (readonly permission mode recommended). 3) Keep N8N_API_KEY and N8N_URL as environment variables (do not store in skill configs) and rotate keys regularly. 4) Confirm the audit log path (/data/.openclaw/logs/n8n-audit.log) is writable only by intended accounts and does not leak sensitive data. 5) Be cautious before following the repository push instructions — pushing to GitHub will publish code externally. If you want higher assurance, request the full validate-setup.sh contents or a code review from a trusted party; doing that could raise this confidence to high.