using-n8n-mcp-skills
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to manage and interpret n8n workflow data (JSON), which creates a potential surface for indirect prompt injection attacks.
- Ingestion points: External workflow structures and node configurations are ingested through tools like
n8n_get_workflowandget_nodeas described in the SKILL.md file. - Boundary markers: The instructions do not define specific boundary markers or delimiters (e.g., XML tags or clear 'ignore' instructions) to separate untrusted workflow content from system instructions.
- Capability inventory: The skill has access to high-impact capabilities including workflow creation (
n8n_create_workflow), modification (n8n_update_partial_workflow), and execution (n8n_test_workflow), which could be abused if malicious instructions are embedded in a workflow JSON. - Sanitization: There is no mention of sanitizing or validating the contents of nodes (such as expressions or code blocks) before the agent processes or executes them.
Audit Metadata