n8n

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:18 AM UTC
• Version: 2.0.0

Overview

This n8n skill is mostly purpose-aligned, but its “dry-run” testing performs real workflow execution and the skill grants live automation control without strong safety gates.

Install only if you are comfortable giving this skill API-level control over your n8n instance. Use a staging instance or least-privileged API key where possible, avoid sensitive test data, and treat dry-run, execute, activate, deactivate, create, and delete operations as live actions that may trigger external services or change business workflows.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill advertises API-driven behavior and explicitly relies on environment variables, local files, and network access, but it does not declare permissions for those capabilities. That creates a transparency and governance gap: a caller may invoke a skill with broader access than expected, including reading secrets from env and making outbound requests to an n8n instance. In this context, undeclared capabilities are more dangerous because the skill can activate, execute, and create workflows that may themselves trigger external side effects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The manifest describes the skill as mainly managing and debugging workflows, but the body documents materially broader capabilities such as creating workflows, running tests, optimization analysis, and according to the finding, update/delete operations. A description-behavior mismatch is dangerous because it undermines informed consent and can cause operators to approve a skill for read/operate tasks when it can perform destructive or side-effecting changes. In an automation platform context, this can lead to accidental modification of production workflows or triggering integrations that affect third-party systems.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The manifest description omits significant capabilities present in the skill content, including workflow creation, testing, and optimization. Even if those functions are legitimate, incomplete disclosure weakens reviewability and increases the chance that a user or policy engine will underestimate what the skill can do. Because n8n workflows can call external APIs and process sensitive data, understating capabilities makes misuse or unsafe invocation more likely.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The method is labeled as a dry run using mock data, but it actually calls execute_workflow and triggers a real workflow execution. In an automation platform, that can cause external side effects such as sending messages, modifying systems, or invoking downstream integrations when a caller expects a safe test-only action.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README instructs users to activate and manually execute workflows but does not warn that these operations can trigger real outbound actions such as emails, webhooks, database writes, or third-party API calls. In an automation skill for n8n, this omission increases the chance of unintended production side effects during testing or debugging.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The README tells users to export an API key in environment variables without any guidance on secure credential handling, such as avoiding shell history leakage, limiting scope, or using a secrets manager. While environment variables are common, omitting basic handling guidance can contribute to accidental credential exposure in shared terminals, logs, or screenshots.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill includes commands for creating, activating, deactivating, and validating workflows without prominently warning that these actions can alter live automation behavior. In n8n, activating or creating workflows may immediately enable triggers or downstream integrations, causing emails, API calls, database writes, or other irreversible effects. The context makes this more dangerous because automation tools often bridge multiple production systems, amplifying the blast radius of a mistaken command.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The manual execution examples show how to trigger workflows directly but do not warn that execution may send data to third-party services, change records, or perform irreversible actions. This is especially risky because the skill encourages building workflows with real HTTP Request and Code nodes, so a manual run can immediately invoke external APIs or business processes. In an automation context, execution examples without safety guardrails can lead to accidental production impact or data leakage.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: delete_workflow performs a destructive API call with no built-in confirmation, safety interlock, or user-facing warning. In an agent skill context, this increases the risk of accidental or prompt-induced deletion of production automations.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: delete_execution removes execution records without any confirmation or disclosure. While less severe than deleting workflows, it can still destroy audit/debugging evidence and interfere with incident response or troubleshooting.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The dry_run function invokes self.client.execute_workflow(workflow_id, data=test_data), which performs a real remote workflow execution rather than a local simulation. In the context of n8n, workflows can send emails, call external APIs, modify databases, or trigger downstream automations, so treating this as a harmless test can cause unintended side effects if users are not explicitly warned or required to confirm networked execution.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.