ClawHub
Back to skill

Security audit

N8n Create Nodes

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only development skill for building n8n community nodes, with expected credential and webhook examples but one credential example that users should handle carefully.

Before installing, treat this as a developer reference that can generate nodes handling real service credentials. Prefer Authorization or custom headers for API keys, use query-string secrets only when an API requires them, keep OAuth scopes minimal, review cloned npm dependencies before use, and do not store secrets in workflow static data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation explicitly recommends placing API keys in URL query parameters without any warning about the security tradeoffs. Query strings are commonly logged by servers, proxies, browser history, monitoring tools, and intermediaries, which can expose secrets far more broadly than headers. In a skill for building production n8n nodes, this pattern is especially risky because developers may copy it directly into real integrations.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.