n8n-self-hosting
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a comprehensive suite of shell commands on a remote Linux server via SSH. This includes installing Docker, configuring system firewalls (ufw), managing file permissions (chmod 600), and orchestrating containerized services via Docker Compose.
- [EXTERNAL_DOWNLOADS]: Fetches the official Docker installation script from
https://get.docker.com. This is a well-known service used for legitimate infrastructure setup. - [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface (Category 8). It ingests untrusted data from external sources such as DNS records (via
dig) and HTTP responses from health check endpoints (viacurl). While the agent has high capabilities (SSH access), the risk is mitigated by the fact that these operations are performed on user-specified targets for deployment verification. - Ingestion points: DNS resolution output (
dig), Public IP lookup (ifconfig.me), and n8n health check responses (/healthz). - Boundary markers: The instructions lack explicit boundary markers for these external data points, relying on standard CLI output parsing.
- Capability inventory: Full shell access over SSH, file system write access, and network utility execution (curl, wget, dig).
- Sanitization: Standard command-line output processing is used without specific sanitization for potential injection payloads in DNS or HTTP metadata.
Audit Metadata