qe-n8n-security-testing
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill contains logic to scan for hardcoded secrets such as API keys, AWS credentials, and OAuth tokens within workflow exports. This feature is intended for defensive auditing to identify accidental data exposure in workflow JSON.
- [COMMAND_EXECUTION]: Payload strings designed to test for command injection and path traversal are included in the skill. These are used as diagnostic input for webhook validation tests and are not executed in the local shell environment.
- [INDIRECT_PROMPT_INJECTION]: The skill processes workflow JSON and execution logs, which represent potential ingestion points for untrusted data. The risk is considered minimal as the skill's capabilities are focused on pattern matching and reporting rather than autonomous execution of instructions found in the data.
- [DYNAMIC_EXECUTION]: Analysis functions are provided to detect the presence of dangerous JavaScript operations like
eval()andnew Function()in workflow expressions. This is a passive security check to prevent unsafe code execution within the n8n environment.
Audit Metadata