n8n-api
2 findings (1 high, 1 medium), mainly data exfiltration, command injection. Most recent scan 2026-02-01.
The n8n-api skill provides legitimate functionality for interacting with n8n's REST API but has several security concerns primarily related to credential management and input validation. The most significant issue is the recommendation to store API keys in plaintext environment variables or unencrypted files without secure storage guidance (HIGH severity). The skill also lacks input validation guidance for webhook paths, creating potential command injection risks (MEDIUM severity), and provides unrestricted API access without least-privilege recommendations (MEDIUM severity). Minor issues include missing metadata fields and lack of rate limiting guidance (LOW severity). The skill does not contain malicious code or intentional backdoors, but the credential handling practices could lead to API key exposure. Overall, this skill requires security hardening around credential management and input validation before production use.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Operate n8n via its public REST API from OpenClaw. Use for workflow management, executions, and automation tasks such as listing, creating, publishing, triggering, or troubleshooting. Works with both self-hosted n8n and n8n Cloud.
- Package
- 2 files, 9.1 KB
- SKILL.md
- 474 words, 12+ sections
- Code
- None. Instructions only.
SKILL.md covers: n8n Public REST API · Availability · Configuration · Auth header · Playground · Quick actions · Workflows: list · Workflows: details · Workflows: activate or deactivate · Activate (publish) · Deactivate · Webhook trigger
Findings
HIGH Hardcoded API credentials in environment variables without secure storage guidance Data Exfiltrationllm
The skill instructs users to store sensitive n8n API keys in environment variables or a plaintext configuration file (.n8n-api-config) without any guidance on secure credential management. API keys provide full access to n8n workflows, executions, and potentially sensitive automation data. Storing these in plaintext environment variables or unencrypted files exposes them to credential theft through process enumeration, file system access, or accidental commits to version control.
SKILL.md
```bash
export N8N_API_BASE_URL="https://your-instance.app.n8n.cloud/api/v1"
export N8N_API_KEY="your-api-key-here"
```
Recommended storage in `.n8n-api-config` file without encryption guidance.MEDIUM Command injection risk in webhook path construction Command Injectionllm
The webhook trigger examples construct URLs using path parameters without validation or sanitization guidance. If the {webhook-path} variable is derived from user input or untrusted sources, it could lead to command injection when used in curl commands via shell interpolation. The skill shows direct variable substitution in bash commands without input validation.
SKILL.md
```bash
curl -s -X POST "$N8N_API_BASE_URL/../webhook/{webhook-path}" \
-H "Content-Type: application/json" \
-d '{"key":"value"}'
```
No validation of {webhook-path} parameter before shell execution.What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 3.7 KB |
assets/n8n-api-endpoints.md | doc | 5.4 KB |
External hosts referenced
your-instance.app.n8n.cloud
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
N8N_API_BASE_URL N8N_API_KEY
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/n8n-api
- Raw scan result: n8n-api-scan.json
- Badge for your README:
- Request a re-scan