Reef n8n Automation

ReviewAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill is coherently focused on building n8n workflows, but users should review imported templates and keep API credentials scoped.

This appears suitable for n8n workflow building. Before installing or using it, make sure the referenced template library is trusted, inspect any template before import, use scoped credentials, and manually test workflows before enabling scheduled, webhook, or production execution.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

A workflow template could contain unexpected nodes, API calls, or field mappings if the local library is stale or untrusted.

Why it was flagged

The skill relies on a large local template library that is not part of the submitted artifact. This is coherent with the stated purpose, but imported workflow templates should be reviewed before use.

Skill content

Build, customize, and deliver n8n workflows using our 2,061-template library. Reference: `~/projects/n8n-workflows/`

Recommendation

Inspect selected template JSON before importing it into n8n, especially credentials, HTTP Request nodes, Code nodes, and activation settings.

Medium

#ASI03: Identity and Privilege Abuse

What this means

Workflows built with real API keys may read or change data in connected client services.

Why it was flagged

The skill explicitly expects workflows to be configured with client API keys. This is normal for n8n integrations, but those credentials can grant authority over third-party accounts.

Skill content

Update credentials (Client's API keys)

Recommendation

Use least-privilege credentials, avoid sharing secrets in prompts or output files, and confirm account-changing actions with the client before activating workflows.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

A misconfigured workflow could send data to the wrong API endpoint or perform unintended changes in connected systems.

Why it was flagged

The skill encourages use of n8n's generic HTTP Request capability. This is purpose-aligned, but it can perform broad actions against external APIs depending on configuration.

Skill content

API call (no native node) | HTTP Request | Works with any REST API

Recommendation

Review HTTP methods, URLs, headers, payloads, and rate limits before running workflows with live credentials.