N8n 1.0.2

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 2:11 AM UTC
• Version: 1.0.0

Overview

This is a straightforward n8n API helper whose powerful workflow actions are mostly disclosed and aligned with its purpose, but users should treat it as able to affect live automations.

Install only if you want an agent to manage a real n8n instance. Use a least-privileged n8n API key when possible, avoid placing the key in shared shell profiles, and manually review workflow IDs and input data before activating, deactivating, executing, or using the Python API's delete/update methods. Prefer installing with a constrained recent requests version.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill explicitly instructs users to set and use environment variables for an API key and to call a remote n8n instance, which means it relies on env and network capabilities without declaring them. Undeclared capabilities reduce transparency and make it harder for operators or policy systems to assess risk before use, especially because the skill can affect live automation systems over the network.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented description presents the skill as primarily managing and inspecting workflows, but the detected behavior includes more destructive operations such as creating, updating, deleting workflows, and deleting execution records. This mismatch can mislead users and reviewers about the true power of the skill, increasing the chance of unauthorized, unsafe, or unexpected changes to production automation assets.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill metadata and CLI surface present this as a workflow/execution management tool, but the client also exposes destructive capabilities including create, update, delete workflow, and delete execution operations that are not reflected in the manifest or user-facing action list. This creates a scope-mismatch hazard: an orchestrating agent or user may trust the skill for read/trigger tasks while hidden write/delete methods remain callable from code paths or future integrations, enabling unauthorized or unexpected state changes in n8n.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill documentation describes activation, deactivation, execution, and workflow-management tasks that can disrupt running automations, but it does not warn users about operational or destructive consequences. In the context of n8n, triggering or disabling workflows can cause service interruption, duplicate actions, unintended downstream effects, or loss of operational history if deletion is supported.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The execute_workflow method forwards arbitrary caller-supplied data directly to the n8n execution endpoint without any validation, allowlisting, dry-run, or confirmation step. In this skill context, manual workflow execution can trigger downstream automations with side effects such as sending messages, calling external APIs, modifying data stores, or invoking secrets-backed nodes, so unreviewed input materially increases the risk of unintended or attacker-influenced actions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0

• Confidence: 96% confidence
• Finding: requests>=2.28.0

Known Vulnerable Dependency: requests==2.28.0 — 7 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +4 more

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: requests==2.28.0

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.