n8n-binary-and-data
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes a pattern for interpolating untrusted data (file metadata from chat uploads) into the AI agent's system prompt to allow tools to identify and process files.
- Ingestion points: File metadata (filenames, extensions) enters the workflow via the 'Chat Trigger' or webhook nodes, as described in 'references/AGENT_TOOL_BINARY.md'.
- Boundary markers: The provided system prompt examples use headers but do not include explicit 'ignore embedded instructions' delimiters or escaping for the interpolated JSON data.
- Capability inventory: The documented patterns involve n8n nodes with significant capabilities, including network operations ('nodes-base.httpRequest'), file system access ('Read/Write Files from Disk'), and custom code execution ('Code node').
- Sanitization: The skill provides a clear warning to 'Treat original filenames... as untrusted data' and recommends validating URLs against SSRF and other attacks, although the specific implementation of these safeguards is not included in the provided snippets.
Audit Metadata