n8n-code-javascript
Warn
Audited by Snyk on Mar 8, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill's documentation and required patterns explicitly show fetching and ingesting open/public user-generated content (e.g., COMMON_PATTERNS.md Pattern 1 mentioning Hacker News, Reddit, RSS feeds) and the BUILTIN_FUNCTIONS.md documents $helpers.httpRequest() for arbitrary URLs, and those ingested pages are parsed and used to drive ranking, aggregation, and downstream actions—so untrusted third-party content can influence tool behavior.
Audit Metadata