Monitor n8n Automations with OpenClaw
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill is an instruction-only monitor for a self-hosted n8n webhook and is generally coherent with its stated purpose, but there are minor metadata inconsistencies and a few operational details you should confirm before installing.
This skill is essentially a set of instructions for calling a webhook you run in your n8n instance. Before installing: - Confirm the webhook URL (N8N_WEBHOOK_URL) will be stored securely (workspace .env) and that the webhook is protected with authentication so external callers cannot query your execution data. The skill requires this variable, but the registry metadata omitted it — set it yourself. - If you enable alerts (Telegram or other channels), make sure you supply and secure any notification tokens/credentials; the skill does not declare or manage those secrets. - Review the imported n8n webhook workflow (template URL shown in README) so you understand exactly what data it returns and ensure it doesn't expose sensitive payloads (API keys, PII) in execution details or logs. - The skill suggests logging health status to a file for heartbeat reading — verify that logs won't contain sensitive execution payloads and are rotated/permissioned appropriately. - Because this is instruction-only (no code installed), the risk surface is limited to the webhook you deploy and any notification channels you wire up. If you want higher assurance, inspect the referenced n8n workflow template and the MCP repository linked in the README before deploying. If you want, I can list specific checks to perform on the n8n workflow template or draft a secure webhook checklist.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.