n8n-project-management

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides Python scripts and curl commands for system setup and integration.
  • Includes code for testing Telegram bot connectivity via requests.
  • Provides a ProjectTaskManager class using gspread and oauth2client to interact with Google Sheets API.
  • Documents curl commands for configuring Telegram webhooks with the user's n8n instance.
  • [EXTERNAL_DOWNLOADS]: References resources from the author's official GitHub repository and well-known services.
  • Links to the source code repository on GitHub belonging to the author 'datadrivenconstruction'.
  • Directs traffic to official API endpoints for Telegram (api.telegram.org) and Google Services.
  • Points to official documentation for n8n.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from external sources (Telegram messages and Google Sheets data).
  • Ingestion points: Reads task status, photo reports, and GPS data from the Telegram Bot API and Google Sheets rows.
  • Boundary markers: The instructions.md explicitly mandates that the assistant must 'Validate inputs before processing'.
  • Capability inventory: The skill includes network operations (Telegram/Google API) and filesystem access (reading credentials.json).
  • Sanitization: The implementation guide suggests structural validation via specific spreadsheet columns and n8n switch nodes to route messages based on expected commands.
  • [SAFE]: Credentials management follows best practices.
  • Uses a local credentials.json file for Google Service Account authentication rather than hardcoding secrets.
  • Uses placeholders for the Telegram BOT_TOKEN, instructing the user on how to securely generate and apply their own token.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 01:08 AM