using-n8n-mcp-skills
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill operates as a router for complex workflow management tasks, creating an attack surface where instructions embedded in processed data could influence agent behavior.
- Ingestion points: The skill facilitates the ingestion of untrusted data from the n8n template library and existing workflow definitions via tools like
n8n_get_workflow,search_templates, andget_template. - Boundary markers: The skill does not explicitly instruct the agent to use delimiters or 'ignore embedded instructions' markers when processing workflow JSON, though it does emphasize the use of a separate
n8n-validation-expertskill. - Capability inventory: The agent is granted high-privilege capabilities, including workflow creation (
n8n_create_workflow), modifying credentials (n8n_manage_credentials), and executing workflows with side effects (n8n_test_workflow). - Sanitization: While the skill mandates the use of
validate_workflow, this tool primarily checks for structural and functional correctness rather than identifying or sanitizing adversarial prompts within workflow metadata or node configurations. - [DYNAMIC_EXECUTION]: The skill provides instructions for the creation and configuration of 'Code nodes' (JavaScript and Python) and the AI-agent-callable 'Custom Code Tool' (
toolCode). This allows for the generation and execution of scripts within the n8n environment. While this is a core functionality of the platform, it represents a dynamic execution surface that must be monitored for the generation of malicious logic.
Audit Metadata