The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The documentation contains instructions to install the n8n-cli utility by piping a script downloaded via curl directly into the shell (| sh). This is a dangerous execution pattern that allows for arbitrary code execution from a non-trusted repository.
Evidence: Found in references/cli_commands.md: curl -sSLf https://raw.github.com/edenreich/n8n-cli/main/install.sh | sh.
[EXTERNAL_DOWNLOADS]: The skill encourages downloading and installing software from untrusted third-party sources via several methods including direct shell scripts and package managers.
Evidence: References to github.com/edenreich/n8n-cli and edenreich/tap/n8n-cli for installation.
[INDIRECT_PROMPT_INJECTION]: The skill implements a framework for ingesting and processing n8n workflow JSON and YAML templates, which could be exploited if malicious instructions are embedded in these files.
Ingestion points: The agent is instructed to load and process files from nathan/workflows/, workflow_registry.yaml, and templates/flows/.
Boundary markers: Absent. There are no explicit instructions to treat the content of these external files as untrusted or to isolate their execution context.
Capability inventory: The skill can trigger external webhooks, manage Docker containers, and execute local shell commands via uv run and docker compose.
Sanitization: While Pydantic is used for basic schema validation, there is no evidence of sanitization to prevent the agent from following instructions embedded within the workflow data or templates.

n8n-development