n8n-workflow-sdk
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions to run a maintenance script,
scripts/refresh-node-registry.sh, which updates the local cache of node definitions. This process involves executing shell commands to interact with official n8n API endpoints and installing official n8n npm packages to ensure data accuracy for the developer. - [EXTERNAL_DOWNLOADS]: The skill facilitates the download of node registry metadata from established n8n service domains (
api.n8n.io) and recommends the installation of well-known development libraries from the npm registry, such as@n8n/workflow-sdk,typescript, andtsx. - [PROMPT_INJECTION]: The skill contains logic for processing and converting user-provided workflow JSON and code. While this functionality inherently accepts untrusted data, it is the primary purpose of the tool and is supported by a comprehensive validation engine designed to identify and flag potential errors or malformed structures in the provided data.
- [SAFE]: No evidence of obfuscation, data exfiltration, or persistence mechanisms was found. The skill explicitly advises users against hardcoding credentials in their workflows and includes built-in validation to detect such security risks.
Audit Metadata