n8n-workflow-patterns

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). Yes — a Google Drive uc?export=download link can host any file (including executables) from personal accounts and is commonly used to distribute malware or obscure origin, so it should be treated as high risk unless the sender and file are verified.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly instructs use of HTTP Request nodes to fetch external APIs (see http_api_integration.md) and describes AI agent tools that call web/document search services (e.g., Serper, Wikipedia, HTTP Request, MCP Client) in ai_agent_workflow.md, meaning the agent will read untrusted, user-generated or public web content and may act on it as part of its workflow.