ClawHub
Back to skill

Security audit

N8n Create Nodes

Security checks for vulnerabilities and agentic risk

Overview

This documentation-only skill is aligned with building n8n community nodes, though users should be careful with its scaffold cleanup command and credential examples.

Use this skill for n8n node package development. Run scaffold commands only in a fresh project directory, verify the working directory before removing `.git`, prefer header-based credential handling unless an API requires query parameters, and test delete/webhook/poll examples with sandbox data before publishing or linking a node into n8n.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)

Credential Access

High
Category
Privilege Escalation
Content
default: 'https://myservice.com/oauth/authorize',
    },
    {
      displayName: 'Access Token URL',
      name: 'accessTokenUrl',
      type: 'hidden',
      default: 'https://myservice.com/oauth/token',
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly instructs users to run `rm -rf .git` after cloning, which is a destructive filesystem command. While the intent is to remove the starter repository history before reinitializing a new project, there is no warning about data loss or safer alternatives, so users could normalize unsafe command use or accidentally run it in the wrong directory.

External Transmission

Medium
Category
Data Exfiltration
Content
description: INodeTypeDescription = {
  // ...standard properties...
  requestDefaults: {
    baseURL: 'https://api.myservice.com/v1',
    headers: { Accept: 'application/json' },
  },
  properties: [
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation explicitly recommends sending an API key in the URL query string, which is a weaker credential transport pattern because URLs are commonly logged by servers, reverse proxies, browser history, monitoring tools, and caches. In a node-development skill, this guidance can propagate into generated integrations and cause downstream credential leakage even if HTTPS is used.

External Transmission

Medium
Category
Data Exfiltration
Content
outputs: [NodeConnectionType.Main],
    credentials: [{ name: 'todoServiceApi', required: true }],
    requestDefaults: {
      baseURL: 'https://api.todoservice.com/v1',
      headers: { Accept: 'application/json' },
    },
    properties: [
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low
Confidence
83% confidence
Finding
This markdown file documents example code that performs a DELETE request against tasks, which is a destructive operation affecting user data. The surrounding documentation does not include any warning, confirmation note, or caution that the example includes deletion behavior.

Missing User Warnings

Low
Confidence
84% confidence
Finding
This markdown file documents code that accepts POSTed webhook bodies and passes them directly into workflow execution, but the surrounding documentation does not warn users that activating such a trigger will ingest external service data into n8n. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data, privacy, or system integrity.

Missing User Warnings

Low
Confidence
78% confidence
Finding
The poll-trigger section explains scheduled API polling and shows retrieval of new items from an external service, but it does not include any warning that enabling the trigger causes recurring outbound requests and imports external data into workflows. For markdown files, the absence of such disclosure is a missing user warning when privacy or system behavior may be affected.

Static analysis

No suspicious patterns detected.