ClawHub
Back to skill

Security audit

Monitor n8n Automations with OpenClaw

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent n8n monitoring helper, but it asks users to import an unpinned external workflow, give it n8n API credentials, and expose sensitive monitoring data through a webhook without documenting strong access controls.

Review the imported n8n workflow before activating it, use a dedicated read-only n8n service account, protect the webhook with strong authentication or private-network controls, and avoid sending raw workflow names, node details, or error messages to Telegram or logs unless they have been sanitized.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
README.md:27
Finding

Unpinned External Workflow Receives Privileged n8n API Credentials

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 27-44
Vulnerability Type: Unreviewed and unpinned external dependency
Risk Level: High

Vulnerable Documentation Snippet:

markdown
Import the monitoring workflow template into your n8n instance:

**Template:** https://n8n.supply-science.com/workflows/DevOps/AI_Agent_for_Debugging_Workflow_Executions

This workflow exposes a single POST webhook with three routes:

| Action | What it returns |
|--------|----------------|
| `get_active_workflows` | List of all active workflows (id, name, timestamps) |
| `get_workflow_executions` | Recent executions with computed KPIs (failure rate, timing, per-workflow metrics) |
| `get_execution_details` | Detailed error data for a specific workflow (error messages, failed nodes) |

After importing:
1. Open the workflow in your n8n editor
2. Replace the n8n API URL with your own instance URL in the HTTP Request nodes
3. Configure the n8n API credentials
4. Activate the workflow
5. Copy the webhook URL (production URL, not test)

Technical Analysis

The package does not include the n8n workflow JSON implementing its core functionality. Instead, users are directed to import a workflow from a third-party website and grant it n8n API credentials. The external artifact is not pinned to a version or content hash, signed, or otherwise made reproducible.

Consequently, the effective workflow reviewed and activated by a user can differ from the content available when this skill was audited. If the hosting account, website, or distributed template is compromised, workflow nodes could be changed to misuse the configured API credentials, transmit n8n data to an attacker-controlled service, or invoke additional operations supported by the credential's permissions.

This is a supply-chain weakness rather than evidence that the currently referenced workflow is malicious.

Attack Path

  1. An attacker compr ...[truncated 1014 chars]
Remediation
View remediation

Remediation Suggestions

  1. Bundle the complete reviewed n8n workflow JSON in the project repository.
  2. Pin the workflow to an immutable release and publish a SHA-256 checksum.
  3. Digitally sign releases and document how users can verify signatures before import.
  4. Document every workflow node, external destination, and required API operation.
  5. Instruct users to inspect the imported workflow before assigning credentials or activating it.
  6. Use a dedicated n8n service account with read-only, least-privilege access limited to the monitoring endpoints.
  7. Avoid granting workflow-management, credential-management, administrative, or unrelated data-access permissions.
  8. Treat template updates as security-sensitive releases and repeat code review and integrity verification for every version.

T09 · Insecure Skill Coding Practices

Warning
Location
README.md:31
Finding

Sensitive Monitoring Webhook Is Documented Without Caller Authentication

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 31-44
Vulnerability Type: Missing webhook authentication and authorization controls
Risk Level: Medium

Vulnerable Documentation Snippet:

markdown
This workflow exposes a single POST webhook with three routes:

| Action | What it returns |
|--------|----------------|
| `get_active_workflows` | List of all active workflows (id, name, timestamps) |
| `get_workflow_executions` | Recent executions with computed KPIs (failure rate, timing, per-workflow metrics) |
| `get_execution_details` | Detailed error data for a specific workflow (error messages, failed nodes) |

After importing:
1. Open the workflow in your n8n editor
2. Replace the n8n API URL with your own instance URL in the HTTP Request nodes
3. Configure the n8n API credentials
4. Activate the workflow
5. Copy the webhook URL (production URL, not test)

Technical Analysis

The documented webhook exposes workflow inventory, execution statistics, and detailed error information. However, the setup instructions do not require caller authentication, request signing, authorization checks, source-network restrictions, or rate limiting. They only instruct the user to copy the production webhook URL.

Under this design, the opaque webhook path may function as a bearer secret. Anyone who learns the URL may be able to invoke the documented actions. URLs can be disclosed through application logs, shell history, environment dumps, screenshots, monitoring systems, proxy logs, or accidental configuration publication.

Detailed execution errors can contain operational data and may include values derived from workflow inputs, external-service responses, database errors, file paths, or node configuration. Returning those details through an unauthenticated endpoint increases the risk of information disclosure.

Attack Path

  1. An attacker obtains the production webhook URL from exposed con ...[truncated 1316 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require a strong authorization token in an HTTP header for every webhook request.
  2. Prefer HMAC-signed requests containing a timestamp and nonce, and reject expired or replayed requests.
  3. Perform authorization before routing or querying the n8n API.
  4. Store authentication secrets in an approved secret manager rather than in source files.
  5. Restrict ingress to trusted OpenClaw hosts through a firewall, VPN, private network, or reverse-proxy allowlist.
  6. Apply per-client rate limits, request-size limits, strict timeouts, and low maximum values for the limit parameter.
  7. Validate actions and workflow IDs against strict allowlists and reject unknown input fields.
  8. Redact credentials, tokens, personal data, query contents, and sensitive upstream responses from returned errors.
  9. Prevent the complete webhook URL and authorization headers from appearing in logs.
  10. Provide documented secret rotation and incident-response procedures for a disclosed webhook URL.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README explicitly recommends sending workflow names, error messages, and failed node details to Telegram, which can expose operationally sensitive data to a third-party messaging platform and to any compromised chat, bot token, or recipient account. In the context of an n8n monitoring/debugging skill, these alerts may include internal system names, query text, resource identifiers, or other failure details that help an attacker map infrastructure or infer secrets.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.