n8n-workflow-sdk
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the official
@n8n/workflow-sdkpackage from the npm registry. This is a standard dependency for n8n workflow development and originates from a well-known service. - [COMMAND_EXECUTION]: Utilizes
npx tsxto run TypeScript scripts for building and deploying workflows, which is expected for the skill's development-focused functionality. - [INDIRECT_PROMPT_INJECTION]: The skill processes local workflow files (
.jsonand.ts) to perform conversions and round-trip operations. It mitigates injection risks by employing the SDK'svalidateWorkflowutility to verify the integrity and structure of the processed definitions before deployment. - [DYNAMIC_EXECUTION]: Employs the SDK's internal interpreter (
parseWorkflowCode) to parse a restricted and safety-scoped subset of TypeScript workflow definitions into standard n8n JSON format. - [CREDENTIALS_UNSAFE]: Demonstrates secure handling of sensitive information by using environment variables (
N8N_API_KEY,N8N_URL) for deployment and placeholder credentials (newCredential) within workflow definitions, avoiding hardcoded secrets.
Audit Metadata