ClawHub
Back to skill

Security audit

n8n-workflow-automation

Security checks for vulnerabilities and agentic risk

Overview

This skill is a read-only n8n workflow design helper with disclosed safeguards and no evidence of hidden execution or data misuse.

Before installing, review any generated n8n workflow for the specific systems, credential scopes, logging destinations, and approval steps it uses, and only activate workflows after confirming they match your intended automation.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Instruction Override

High
Category
Prompt Injection
Content
- Make this n8n flow idempotent so it does not duplicate records when it reruns.
  - Instrument this workflow with audit logs and a human approval step.
- DO NOT USE WHEN�?  - You need code-only automation without n8n (use a scripting/CI skill).
  - You need to bypass security controls or hide audit trails.
  - You need to purchase or recommend prohibited items/services.

## INPUTS
Confidence
90% confidence
Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
---
name: n8n-workflow-automation
version: 1.0.0
description: "Design and output n8n workflow JSON with robust triggers, idempotency, error handling, and human-..."
Confidence
60% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Static analysis

No suspicious patterns detected.