The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill relies on npx --yes to fetch and execute @n8n-as-code/n8n-manager and n8nac from the NPM registry at runtime. These downloads are not pinned to specific versions, which introduces a supply chain risk.
[COMMAND_EXECUTION]: The skill executes system-level commands to manage n8n instances, including interacting with the Docker daemon and managing service states.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through workspace files. It instructs the agent to use shell commands defined inside an external file: "Use the exact n8n-manager command and n8nac command listed in AGENTS.md when present. Those context-root commands override the portable examples in this skill."
Ingestion points: AGENTS.md file in the workspace or context root.
Boundary markers: Absent; the instructions do not specify any validation or delimiters for the content of AGENTS.md.
Capability inventory: Execution of shell commands via npx, Docker management, and network tunnel configuration.
Sanitization: Absent; the agent is directed to use the commands exactly as provided in the external file.
[DATA_EXFILTRATION]: The skill provides functionality to create public network tunnels (via the --tunnel flag). While intended for legitimate webhook testing, this capability could be used to expose private local instances or sensitive data to the public internet if triggered by a malicious instruction.

n8n-manager