AutomateLab n8n
PassAudited by VirusTotal on May 10, 2026.
Overview
Type: OpenClaw Skill Name: automatelab-n8n Version: 0.0.2 The skill provides a set of tools and detailed technical context for an AI agent to generate, scaffold, and lint n8n workflows. It utilizes the '@automatelab/n8n-mcp' npm package as an MCP server. The instructions in SKILL.md are well-structured, focusing on n8n-specific logic such as auto-iteration, LangChain AI node connections, and JSON schema requirements, with no evidence of malicious intent, data exfiltration, or prompt injection.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Enabling the skill runs code from the referenced npm package in the user's environment.
The skill depends on an external npm package run through npx as its MCP server. This is expected for the stated MCP integration, but users should recognize that package code is outside the provided artifact review and the setup example is not version-pinned.
"command": "npx", "args": ["-y", "@automatelab/n8n-mcp"]
Verify the npm package and repository before enabling it, and pin or otherwise control the package version if your environment requires stronger supply-chain guarantees.
A generated workflow could perform external API calls, run code, or invoke sub-workflows if the user imports and runs it.
The skill can generate n8n workflow artifacts that include action-capable nodes. This matches the workflow-building purpose, but those artifacts may contact services or run code once the user imports and executes them in n8n.
Tool nodes can wrap arbitrary HTTP requests, sub-workflows, or Code.
Review generated workflow JSON and custom TypeScript nodes before importing or executing them, especially any HTTP Request, Code, credentialed, or AI-agent tool nodes.