Security audit

N8n

Security checks across malware telemetry and agentic risk

Overview

This n8n skill is not malware, but it can change and run live automations with too little safety framing.

Install only if you are comfortable giving the agent access to a real n8n API key. Prefer a staging n8n instance or restricted API key, treat dry-run/test commands as live executions, and require explicit confirmation before create, activate, deactivate, or execute operations on production workflows.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill clearly relies on environment secrets, local file access, and network/API operations, yet the manifest does not declare permissions for those capabilities. That creates a transparency and control gap: operators may invoke a skill with broader effective access than the manifest suggests, which is risky for a skill that can interact with live automation infrastructure.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The manifest frames the skill as basic workflow management and debugging, but the documentation exposes materially broader capabilities such as workflow creation, destructive management actions, test execution, and optimization/reporting behavior. This mismatch can mislead users and security reviewers about the operational and security impact of invoking the skill, especially because it can modify or trigger live workflows connected to external systems.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The manifest description omits workflow creation and optimization capabilities that the body presents as core functions. In a security-sensitive automation context, incomplete disclosure increases the chance that users authorize or run a skill without understanding that it can build new workflows or alter operational behavior beyond simple inspection.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README explicitly instructs users to activate and execute workflows but does not warn that these operations can trigger real-world side effects in integrated systems such as email, CRM, databases, or webhooks. In an automation skill for n8n, this omission increases the risk of unintended production actions during testing or debugging, especially because the skill promotes manual execution and rapid deployment flows.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The setup instructions tell users to export an API key and base URL but provide no guidance on secure credential handling, such as avoiding shell history leakage, not hardcoding secrets, and using secret managers or protected environment files. While this is documentation-level rather than code-level exposure, it can still contribute to accidental credential disclosure or unsafe operational practices.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation includes actions that can activate, deactivate, create, execute, and potentially delete or alter automation behavior, but it does not prominently warn that these may impact production systems, downstream APIs, or data integrity. In the n8n context, manual execution or activation can immediately trigger side effects in connected services, making missing safety warnings more dangerous.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The CLI allows creating workflows and activating/deactivating them immediately against a remote n8n instance without any confirmation, dry-run, or explicit user-facing warning. In an agent skill context, this increases the risk of unintended state-changing operations, potentially enabling workflow deployment or activation based on ambiguous or manipulated prompts.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The execute action forwards user-supplied JSON directly to the n8n API and triggers workflow execution without an explicit disclosure or confirmation step. In this skill context, that is risky because workflows may perform sensitive downstream actions such as sending data to third parties, mutating systems, or invoking privileged automations using stored n8n credentials.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The `dry_run` method directly calls `self.client.execute_workflow(workflow_id, data=test_data)`, which appears to invoke a real n8n workflow execution rather than a sandboxed simulation. In an automation skill, workflows may send emails, modify databases, call external APIs, or trigger downstream systems, so labeling this as a dry-run without an explicit warning, confirmation, or safe-mode guard can cause unintended real-world side effects.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.