n8n工作流自动化

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:13 AM UTC
• Version: 1.0.0

Overview

The skill is not clearly malicious, but it can change live n8n workflows and expose credentials or operational data without enough safeguards.

Install only if you understand and control the n8n instance, URL, API key, backup directory, and webhook destination. Avoid using this against production workflows until schedule changes are fixed to preserve existing nodes, require confirmation, and make backups; use least-privilege API keys, prefer HTTPS, avoid putting secrets directly on the command line, and assume exported workflows and alert messages may contain sensitive business data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: n8n-cli.py:226

Finding

n8n API Key Exposed Through Command-Line Arguments

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: n8n-cli.py:83

Finding

API Credentials Can Be Sent to Unvalidated or Unencrypted Destinations

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: n8n-cli.py:190

Finding

Raw Workflow Error Information Forwarded to an Unrestricted Webhook

Content

View full analysis

Remediation

View remediation

other

Error

• Location: n8n-cli.py:143

Finding

Schedule Command Can Destructively Replace Existing Workflow Contents

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The schedule command does not append or modify a trigger safely; it replaces the target workflow with a new definition containing only a Cron node and sets it active. This can destroy existing workflow logic and cause denial of service, loss of automation behavior, or unintended operational changes on the remote n8n instance.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises capabilities that imply network access and writing backups/exports, but it does not declare any explicit tool scope or permission boundaries. This creates a least-privilege and transparency problem: an agent or user cannot clearly see what operations are expected, increasing the risk of overbroad execution or unintended data modification/exfiltration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill promotes bulk import, backup/restore, scheduling, monitoring, and cross-system data transmission without any warning about operational impact, overwrite risk, sensitive-data handling, or the need for user confirmation. In this context, these actions could overwrite workflows, copy sensitive business data, or push information to external systems automatically, making accidental misuse materially more dangerous.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instructions explicitly tell users to supply n8n API keys and webhook URLs, but they provide no guidance on secure storage, redaction, least privilege, or avoiding exposure in logs/history. Those credentials can grant workflow administration or message delivery capabilities, so leakage through shell history, screenshots, shared docs, or agent logs could lead to unauthorized access or data exfiltration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The export command writes a full workflow backup to local disk without warning that workflows may include sensitive business logic, endpoints, and embedded configuration details. In shared systems or poorly protected directories, this can expose confidential automation data to other local users or through later file leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This command performs an immediate remote update that overwrites workflow configuration without an explicit warning or confirmation. Because it alters active automation on a live n8n instance, accidental execution can break workflows or replace intended logic with an incomplete definition.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The monitoring command forwards workflow names and execution error messages to an external webhook without warning that operational data may leave the n8n environment. Error messages often contain URLs, identifiers, partial payloads, or other sensitive context, so this can become an unintended data exfiltration path.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The code sends aggregated execution failure details to a user-provided external webhook. In this skill context, workflows and errors may contain sensitive operational information, making this a genuine data-transmission risk if the webhook points to an untrusted or third-party endpoint.

Content

Scanner excerpt · n8n-cli.py (reported line 196)May include surrounding context.

python

content = f"⚠️ n8n工作流异常告警\n共发现{len(executions)}个失败任务：\n"
                    for exec in executions:
                        content += f"- 工作流：{exec['workflow']['name']}\n  错误：{exec['error']['message']}\n"
                    requests.post(args.webhook, json={"msgtype": "text", "text": {"content": content}})
                    print("✅ 告警已推送到企业微信")
                except:
                    pass

Tainted flow: 'content' from requests.get (line 193, network input) → requests.post (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · n8n-cli.py (reported line 196)May include surrounding context.

python

content = f"⚠️ n8n工作流异常告警\n共发现{len(executions)}个失败任务：\n"
                    for exec in executions:
                        content += f"- 工作流：{exec['workflow']['name']}\n  错误：{exec['error']['message']}\n"
                    requests.post(args.webhook, json={"msgtype": "text", "text": {"content": content}})
                    print("✅ 告警已推送到企业微信")
                except:
                    pass

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script's docstrings, help strings, template names, and console output are consistently hard-coded in Chinese, with no option to select another language. This creates a natural-language policy issue because the tool forces a specific locale on all users without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.