ClawHub
Back to skill

Security audit

N8n Code Automation Nelmaz

Security checks for vulnerabilities and agentic risk

Overview

This n8n automation skill has a plausible purpose, but the package includes an older nested skill that still directs credentials and workflow operations to a fixed third-party host.

Review before installing. Use only a user-controlled N8N_URL, do not put n8n API keys in OpenClaw config files, prefer read-only or narrowly scoped keys, and avoid loading or relying on the bundled nested v1.0.0 skill unless it is removed or corrected.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

other

Error
Location
skills/n8n-code-automation-nelmaz/SKILL.md:16
Finding

API credentials and workflow data are transmitted to a hardcoded third-party host

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
skills/n8n-code-automation-nelmaz/SKILL.md:23
Finding

API key is persisted in a plaintext OpenClaw configuration file

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
skills/n8n-code-automation-nelmaz/SKILL.md:130
Finding

Destructive workflow operations lack enforceable least-privilege and authorization controls

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
_meta.json:3
Finding

Release advertises security fixes while bundling the deprecated insecure Skill

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (13)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description is broad enough to match many generic coding and automation requests, which can cause the agent to invoke this skill in situations where external workflow execution or modification is unnecessary. In this context, over-broad activation increases the chance of unintended access to external systems and side-effectful operations through n8n.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
4. **No Audit Logging** - Complete audit trail with timestamps implemented
5. **No Rate Limiting** - Configurable rate limits to prevent abuse
6. **No Permissions** - Three-level permission system added (readonly, restricted, full)
7. **No Confirmation** - Two-factor confirmation for dangerous operations

### 🔐 New Security Features

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

1. List Workflows

bash
curl -X GET "$N8N_URL/api/v1/workflows" \
  -H "X-N8N-API-KEY: $N8N_API_KEY" \
  -H "Content-Type: application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This example automatically executes a remote n8n workflow from GitHub Actions on every push to main, creating an external side effect channel from repository events into automation infrastructure. If the workflow is powerful or misconfigured, commits can trigger deployments, data changes, notifications, or other privileged actions without an explicit human approval step.

Content

Scanner excerpt · SKILL.md (reported line 300)May include surrounding context.

md
N8N_URL: ${{ secrets.N8N_URL }}
          N8N_API_KEY: ${{ secrets.N8N_API_KEY }}
        run: |
          curl -X POST "$N8N_URL/api/v1/workflows/${{ secrets.N8N_WORKFLOW_ID }}/executions" \
                -H "X-N8N-API-KEY: $N8N_API_KEY" \
                -H "Content-Type: application/json" \
                -d '{"data": {"contextData": {"commitSha": "${{ github.sha }}"}}}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The quick-start example tells users how to execute a workflow but does not warn that execution may trigger external actions such as deployments, database writes, notifications, or destructive automation. Because this is presented as a simple startup path, users may run it without understanding operational side effects.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
72% confidence
Finding

The broad trigger configuration increases the chance that the skill will be invoked repeatedly across a session whenever generic workflow-related language appears, effectively persisting access to automation capabilities beyond narrowly scoped user intent. In combination with external execution and modification features, this raises the risk of unintended continued use of a powerful state-changing skill.

Content

Scanner excerpt · skills/n8n-code-automation-nelmaz/SKILL.md (reported line 3)May include surrounding context.

md
---
name: n8n-code-automation
description: Integrate n8n workflow automation into coding tasks. Use when building automated workflows, integrating n8n into development pipelines, executing existing workflows, modifying workflow configurations, or creating new automation solutions. Triggers on phrases like "create n8n workflow", "run n8n workflow", "integrate n8n", "automate with n8n", "modify n8n workflow", "execute workflow".
---

# N8N Code Automation

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrase list includes the generic phrase "execute workflow," which is broad enough to activate this skill in contexts unrelated to n8n or without clear user intent to perform automation. Because the skill supports state-changing operations like executing, updating, cloning, and deleting workflows, accidental activation could lead to unintended external actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

This command sends authenticated requests to an external n8n service, which creates a channel for transmitting workflow metadata and potentially sensitive operational information outside the local environment. While expected for the skill's purpose, it is still security-relevant because the skill encourages live interaction with a remote automation platform using API credentials.

Content

Scanner excerpt · skills/n8n-code-automation-nelmaz/SKILL.md (reported line 42)May include surrounding context.

Command:

bash
curl -X GET "https://n8n.nelflow.cloud/api/v1/workflows" \
  -H "X-N8N-API-KEY: your-api-key" \
  -H "Content-Type: application/json"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This section provides direct instructions for executing, cloning, updating, and deleting workflows against a live remote n8n instance but does not present a clear warning that these operations can modify external systems, trigger downstream automations, or destroy data. In a skill meant for coding assistance, omission of explicit side-effect warnings increases the risk that an agent will carry out destructive or irreversible actions without adequate user awareness or confirmation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This GitHub Actions example automatically sends repository metadata and commit information to an external n8n endpoint using a secret API key. In CI/CD contexts, automated external transmission is more dangerous because it can occur without interactive review and may trigger downstream workflows with broad access to infrastructure or production systems.

Content

Scanner excerpt · skills/n8n-code-automation-nelmaz/SKILL.md (reported line 261)May include surrounding context.

md
steps:
      - name: Trigger N8N workflow
        run: |
          curl -X POST "https://n8n.nelflow.cloud/api/v1/workflows/YOUR_WORKFLOW_ID/executions" \
            -H "X-N8N-API-KEY: ${{ secrets.N8N_API_KEY }}" \
            -H "Content-Type: application/json" \
            -d "{\"data\": {\"contextData\": {\"commitSha\": \"${{ github.sha }}\", \"repoUrl\": \"${{ github.server_url }}/${{ github.repository }}\"}}}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 518)May include surrounding context.

md
"name": "Fetch Data",
      "parameters": {
        "method": "GET",
        "url": "https://api.example.com/data"
      }
    },
    {

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skills/n8n-code-automation-nelmaz/SKILL.md (reported line 407)May include surrounding context.

md
"name": "Fetch Data",
      "parameters": {
        "method": "GET",
        "url": "https://api.example.com/data"
      }
    },
    {

Excessive Permissions

Low
Category
Privilege Escalation
Confidence
80% confidence
Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
- **Input Validation:** URL format validation + data sanitization
- **Audit Logging:** Complete action trail in `/data/.openclaw/logs/n8n-audit.log`
- **Rate Limiting:** Configurable limits (10 req/min by default)
- **Granular Permissions:** 3 levels - readonly, restricted, full
- **HTTPS Enforcement:** Only HTTPS connections allowed
- **Confirmation Required:** Two-factor for dangerous operations

Static analysis

No suspicious patterns detected.