n8n Builder

Expert n8n workflow builder that creates, deploys, and manages n8n workflows programmatically via the n8n REST API. Use when asked to create n8n workflows, automate n8n tasks, build automations, design workflow pipelines, connect services via n8n, or manage existing n8n workflows. Handles webhook flows, scheduled tasks, AI agents, database syncs, conditional logic, error handling, and any n8n node configuration.

This skill appears to do what it claims (create/activate/manage n8n workflows via the n8n API), but the package metadata is incomplete. Before installing or running it: (1) do not provide your N8N_API_KEY to an untrusted skill — verify the skill's source and review scripts; (2) confirm N8N_URL and N8N_API_KEY are required (SKILL.md and scripts/n8n-api.sh require them) even though the registry metadata omitted them; (3) ensure curl and jq are available in the runtime environment (the script uses both); (4) review any workflow JSON the skill would send to your n8n instance before deployment to avoid injecting unwanted credentials/actions; and (5) consider running the script in an isolated environment or with a limited-permission API key for testing. These metadata mismatches are the main red flags — they may be benign oversights, but proceed cautiously.

Type: OpenClaw Skill Name: n8n-builder Version: 1.0.0 The skill bundle is classified as suspicious due to a critical shell injection vulnerability in `scripts/n8n-api.sh`. The script directly uses unsanitized arguments (`$2`, `$3`) as file paths for `curl -d @`, which can be exploited via prompt injection against the AI agent to execute arbitrary commands on the host system (RCE). This vulnerability, combined with the agent's ability to create and manage n8n workflows (which can perform sensitive operations like arbitrary code execution, HTTP requests, and database interactions), poses a significant security risk.