skills/datadrivenconstruction/ddc_skills_for_ai_agents_in_construction/n8n-project-management/Gen Agent Trust Hub
n8n-project-management
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides Python scripts and
curlcommands for system setup and integration. - Includes code for testing Telegram bot connectivity via
requests. - Provides a
ProjectTaskManagerclass usinggspreadandoauth2clientto interact with Google Sheets API. - Documents
curlcommands for configuring Telegram webhooks with the user's n8n instance. - [EXTERNAL_DOWNLOADS]: References resources from the author's official GitHub repository and well-known services.
- Links to the source code repository on GitHub belonging to the author 'datadrivenconstruction'.
- Directs traffic to official API endpoints for Telegram (
api.telegram.org) and Google Services. - Points to official documentation for n8n.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from external sources (Telegram messages and Google Sheets data).
- Ingestion points: Reads task status, photo reports, and GPS data from the Telegram Bot API and Google Sheets rows.
- Boundary markers: The
instructions.mdexplicitly mandates that the assistant must 'Validate inputs before processing'. - Capability inventory: The skill includes network operations (Telegram/Google API) and filesystem access (reading
credentials.json). - Sanitization: The implementation guide suggests structural validation via specific spreadsheet columns and n8n switch nodes to route messages based on expected commands.
- [SAFE]: Credentials management follows best practices.
- Uses a local
credentials.jsonfile for Google Service Account authentication rather than hardcoding secrets. - Uses placeholders for the Telegram
BOT_TOKEN, instructing the user on how to securely generate and apply their own token.
Audit Metadata