n8n-mcp-tools-expert
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of user-supplied data—including search queries, node configurations, and workflow update 'intents'—which are passed to tools capable of modifying or creating n8n workflows. This ingestion of untrusted data without boundary markers makes the agent susceptible to instructions embedded within the processed data.
- Ingestion points: User-provided parameters such as
queryinsearch_nodes,configinvalidate_node, andintentinn8n_update_partial_workflow, as described inSKILL.mdandreferences/detailed-guide.md. - Boundary markers: The instructions do not prescribe the use of delimiters (like XML tags or triple quotes) or specific 'ignore embedded instructions' warnings when handling user data.
- Capability inventory: The environment includes powerful tools for workflow creation (
n8n_create_workflow), modification (n8n_update_partial_workflow), and template deployment (n8n_deploy_template), which can include configuring nodes that execute JavaScript or Python code. - Sanitization: While the guide mentions an 'Auto-sanitization' feature for fixing node property structures, there is no mention of sanitizing or escaping the content of user-provided strings to prevent prompt-level injection.
Audit Metadata