Paste an API token into an HTTP Request node's Authorization header instead of a credential and it is saved in plain text in the workflow: download the workflow to share it, post it as a template or commit it to git, and the token goes with it. A Webhook left on Authentication: None that feeds {{ $json.body.file }} into an Execute Command node lets anyone who finds the URL run commands on your n8n server, and a test call you pinned can keep your n8n-auth session cookie in the file. This skill finds those and nine other n8n mistakes in exported files, and tells you how to fix each one.

Your agent runs a scanner on your n8n workflow JSON files: single exports (Download or copied nodes), n8n export:workflow files with one or many workflows, and templates. It also reads credential exports and n8n's .n8n/config settings file. It parses each file to the exact line, knows each node by its type (Webhook, HTTP Request, Code, Execute Command, SSH, Postgres, MySQL, Chat and MCP triggers and more), treats values that start with = as n8n expressions, and tells expressions that read incoming data ($json, $input, $('Node'), $fromAI()) from safe ones ($now, $execution). Credentials referenced by id and name are fine, and Supabase anon keys are not reported. It never imports, activates or runs a workflow. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• N01: tokens, passwords and keys written into node parameters (Authorization and API-key headers, query keys, user:password URLs, Set fields, JSON bodies, Code nodes, Telegram bot tokens, Slack and Discord webhook URLs, provider keys)

• N02: Execute Command and SSH commands built from incoming data or AI tool input

• N03: credential exports made with --decrypted, with every secret in plain text

• N04: n8n's settings file with the instance encryption key

• N05: Authorization headers, session cookies and tokens saved in pinned data

REVIEW (check before release)

• N11: Webhook and MCP Server triggers with no authentication, and public chats without login

• N12: Code and Function nodes using child_process, fs, eval or new Function (Python: subprocess, eval, exec)

• N13: allowUnauthorizedCerts (Ignore SSL Issues) turned on

• N14: real-looking emails, phone numbers, addresses and ID or card numbers in pinned data

• N15: SQL queries with expressions from incoming data instead of query parameters

• N16: HTTP requests to remote hosts over plain http://

• N17: workflows any workflow on the instance can call (callerPolicy any)

• N18: Read/Write Files from Disk paths built from incoming data

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example project (two workflows, a credentials export and an n8n data folder), and the real report the scanner produces on the risky one

Limits

It reads the exported files as written. Credentials stored inside n8n, instance settings and environment variables (such as NODE_FUNCTION_ALLOW_BUILTIN or N8N_RESTRICT_FILE_ACCESS_TO), community node internals and run-time data are not checked, and workflows kept only in the n8n database must be exported first. Form triggers are not reported. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 16 files: SKILL.md, the scanner in scripts/ (5 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (8 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.