n8n-credentials-and-security-official
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as an educational and prescriptive guide for security best practices in n8n. It explicitly defines "Non-negotiables" to prevent sensitive data exposure.
- [DATA_EXPOSURE_PREVENTION]: The instructions identify and provide fixes for common anti-patterns that lead to secret leakage, such as pasting API keys into Authorization headers, using Set nodes for tokens, or hardcoding credentials in SDK code.
- [CREDENTIALS_SAFE]: The skill mandates the use of
newCredential()andlist_credentials()to ensure secrets are referenced by ID and stored encrypted at rest in the n8n database, rather than being exported in plain-text workflow JSON. - [PROMPT_INJECTION_MITIGATION]: Includes a specific protocol for handling sensitive data pasted into chat by users. It instructs the agent to avoid insecure storage, move the data to the credential system, and explicitly warn the user that the secret is compromised and must be rotated.
Audit Metadata