n8n-workflow-sdk
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill correctly demonstrates the use of environment variables (
$env.API_KEY,process.env.N8N_API_KEY) for managing sensitive credentials. This follows standard security practices for secret management and avoids hardcoding tokens. - [SAFE]: The skill references the installation of the
@n8n/workflow-sdkpackage. This is a scoped package belonging to a well-known service provider (n8n), consistent with the skill's stated purpose of programmatic workflow creation. - [SAFE]: All network operations documented in the code snippets target well-known and legitimate service endpoints (Salesforce, Mailchimp, Clearbit) or a user-defined n8n instance URL. There are no signs of data exfiltration to untrusted or suspicious domains.
- [SAFE]: The use of the n8n
codenode is presented as a mechanism for data transformation within the n8n platform's execution environment. The skill provides static templates for these operations without introducing dynamic execution of untrusted input. - [SAFE]: The skill identifies a potential attack surface for indirect prompt injection as it processes data from webhooks and external APIs within an AI agent node. However, it follows the platform's standard architectural patterns for building automation pipelines.
Audit Metadata