n8n-expression-syntax
Pass
Audited by Gen Agent Trust Hub on May 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists entirely of instructional markdown and code snippets regarding n8n expression syntax. No malicious logic, obfuscation, or unauthorized access patterns were detected.
- [DATA_EXFILTRATION]: The skill explains how to access environment variables via
$envfor use in expressions. Importantly, it includes a safety best practice section explicitly advising against using expressions for credentials, recommending instead the use of the official n8n credential system. - [REMOTE_CODE_EXECUTION]: Code examples demonstrate standard JavaScript methods (e.g.,
.toLowerCase(),.split(),.toFormat()) that are executed within the context of the n8n expression engine. No patterns for arbitrary remote code execution or shell command injection were found.
Audit Metadata