n8n@2.99.1
CAUTIONPublisher claims: "Bridges n8n's workflow automation platform with AI models, providing access to 543 n8n nodes, workflow templates, and AI-capable automation tools." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry Docker MCP CatalogPublisher czlonkowski · joined 1 days agoInstalls 158KLast detonated 1 h ago
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-26 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
Static findings
HIGH
Access to sensitive file pathsdata/skills/n8n-self-hosting/README.md:86 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Access to sensitive file pathsdata/skills/n8n-self-hosting/SKILL.md:89 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Access to sensitive file pathsdata/skills/n8n-self-hosting/SKILL.md:52 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Access to sensitive file pathsdata/skills/n8n-self-hosting/SKILL.md:43 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Persistence: instructs the agent to auto-load this skill in future sessionsdata/skills/n8n-code-javascript/SKILL.md:3 · Persistence: instructs the agent to auto-load this skill in future sessionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01HIGH
Access to sensitive file pathsdata/skills/n8n-self-hosting/README.md:84 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Access to sensitive file pathspackage.json:145 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05CRITICAL
Rule modification attemptdata/skills/n8n-multi-instance/SKILL.md:117 · Rule modification attempt — overwriting existing instructionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01CRITICAL
Privileged sudo commanddata/skills/n8n-self-hosting/SKILL.md:58 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
File permission modification commanddata/skills/n8n-self-hosting/SKILL.md:100 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05HIGH
Access to sensitive file pathsdata/skills/n8n-self-hosting/SKILL.md:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Access to sensitive file pathsdocker/README.md:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
npx invocation of non-well-known packagedata/skills/using-n8n-mcp-skills/SKILL.md:119 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06CRITICAL
Privileged sudo commanddata/skills/n8n-self-hosting/SKILL.md:8 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Access to sensitive file pathsdata/skills/n8n-self-hosting/SKILL.md:53 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Refusal suppressiondata/skills/n8n-code-python/SKILL.md:271 · Refusal suppression — attempting to prevent safety responsesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01HIGH
Persistence: instructs the agent to auto-load this skill in future sessionsdata/skills/n8n-node-configuration/SKILL.md:3 · Persistence: instructs the agent to auto-load this skill in future sessionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01HIGH
Access to sensitive file pathsdata/skills/n8n-self-hosting/README.md:77 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Access to sensitive file pathsdocker/README.md:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Refusal suppressiondata/skills/n8n-code-javascript/SKILL.md:37 · Refusal suppression — attempting to prevent safety responsesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01HIGH
File permission modification commanddata/skills/n8n-self-hosting/SKILL.md:110 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05HIGH
Access to sensitive file pathsdata/skills/n8n-self-hosting/README.md:76 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05MEDIUM
MCP server using network transport (SSE/HTTP)src/config/n8n-api.ts:103 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04HIGH
npx invocation of non-well-known packagesrc/mcp/server.ts:4866 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
npx invocation of non-well-known packagesrc/mcp/server.ts:91 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
npx invocation of non-well-known packagepackage.json:26 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Access to sensitive file pathsscripts/publish-npm.sh:83 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05MEDIUM
MCP server using network transport (SSE/HTTP)src/http-server.ts:275 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04MEDIUM
MCP server using network transport (SSE/HTTP)data/skills/n8n-mcp-tools-expert/SKILL.md:330 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04HIGH
npx invocation of non-well-known packagesrc/mcp/index.ts:207 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
File type combined with upload actiondata/skills/n8n-code-javascript/SKILL.md:137 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07HIGH
Access to sensitive file pathsscripts/deploy-http.sh:12 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
npx invocation of non-well-known packagesrc/mcp/server.ts:81 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Access to sensitive file pathsscripts/deploy-http.sh:11 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Access to sensitive file pathsscripts/deploy-http.sh:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05MEDIUM
File type combined with upload actiondata/skills/n8n-code-javascript/SKILL.md:303 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07HIGH
Access to sensitive file pathsscripts/deploy-http.sh:14 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Access to sensitive file pathsscripts/publish-npm.sh:53 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
npx invocation of non-well-known packagescripts/publish-npm.sh:114 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Access to sensitive file pathssrc/mcp/tool-policy.ts:109 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Access to sensitive file pathssrc/mcp/tool-policy.ts:38 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05What would make this Verified
12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Privileged sudo command≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Unclaimed publisher≈ +8 on the totalClaim czlonkowski: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- File permission modification command≈ +4 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
- npx invocation of non-well-known package≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
- MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
Publish a new version to Docker MCP Catalog, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim czlonkowski