The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of systems that ingest untrusted data from external sources (webhooks, social media feeds, research data) and feed it into AI agent prompts (Claude Code). This creates a significant surface for indirect prompt injection attacks.
Ingestion points: The MCP Server Trigger nodes described in mcp-server-setup.md and EXAMPLES.md are designed to receive arbitrary data from webhooks and external APIs.
Boundary markers: The provided prompt templates and workflow examples do not demonstrate the use of delimiters or explicit instructions to prevent the AI from following commands embedded in the external data.
Capability inventory: The n8n workflows enable highly privileged operations including database writes, email/Slack distribution, and HTTP requests to arbitrary endpoints.
Sanitization: While a security checklist in README.md mentions validation, the functional examples lack concrete implementation of data sanitization or escaping before the data is interpolated into prompts.
[DYNAMIC_EXECUTION]: EXAMPLES.md (Example 3: Database Query Tool) provides a code snippet for building SQL queries using string concatenation (where.push(email = '${email}')). This is a classic SQL injection pattern that is inherently dangerous if parameters come from untrusted sources, even though the text provides a high-level warning to use parameterized queries in production.

n8n-mcp-orchestrator