n8n
Warn
Audited by Gen Agent Trust Hub on Mar 18, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The MCP server configuration instructs the agent to download and execute the
@czlonkowski/n8n-mcppackage from the public NPM registry usingnpx -y. This dependency originates from a third-party author not listed as a trusted vendor. - [COMMAND_EXECUTION]: The documentation provides multiple examples of complex shell command pipelines. These include using
curlto interact with remote APIs, piping output tojqfor parsing, and utilizingwhileloops to perform iterative operations like workflow restoration or batch execution deletion. - [REMOTE_CODE_EXECUTION]: The skill facilitates the creation and management of n8n workflows that contain arbitrary JavaScript code within 'Code' nodes for ETL transformations. This represents dynamic code generation and deployment into the n8n environment.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It ingests untrusted data from external sources—such as workflow execution outputs and webhook payloads—and processes this data through shell commands or workflow definitions without explicit boundary markers or sanitization logic. This exposure is significant given the skill's capabilities to delete resources and manage credentials.
- [EXTERNAL_DOWNLOADS]: Fetches data from external endpoints (e.g.,
api.example.com) during workflow execution examples, demonstrating network connectivity to non-whitelisted domains for automation tasks.
Audit Metadata