n8n-io/n8n

Why it got this result

The MCP Trigger node offers an n8nOAuth2 authentication mode (v2+) that delegates to n8n's platform-wide OAuth 2.1 authorization server, which this repo implements with PKCE (S256-only code_challenge_methods_supported), RFC 8414/9728 discovery metadata (/.well-known/oauth-authorization-server, /.well-known/oauth-protected-resource), RFC 7591 dynamic client registration, and per-(user,client) persisted consent -- i.e. the full MCP Authorization spec flow, not merely static API keys. Bearer/Header auth modes also exist as simpler alternatives but n8nOAuth2 satisfies the rule's OAuth 2.1 requirement for the remote transport.

Why it matters

Misconfig enables token theft and confused-deputy attacks.

Evidence

if (context.getNodeParameter('authentication') === 'n8nOAuth2') {
	if (context.getNode().typeVersion < 2) {
		resp.writeHead(401);
		resp.end('OAuth2 authentication requires mcp trigger node v2.0 or higher');
		return { noWebhookResponse: true };
	}
	const authResult = await n8nOAuth2Auth(context, { realm: 'n8n MCP Server' });
	if (authResult === 'handled') { return { noWebhookResponse: true }; }
	await context.establishTriggerIdentity(authResult.token, authResult.resource, authResult.user.id);
	authedUser = authResult.user;
}

Why it got this result

The MCP Trigger server does not expose a generic/catch-all tool; the only tools surfaced are whichever specific n8n nodes the WORKFLOW AUTHOR explicitly wires into the AiTool input (getConnectedTools in utils/helpers.ts), so capability scope is bounded by the workflow design, not by the MCP server itself granting broad access. Tool arguments are further sanitized against each tool's own JSON-schema (runtime.ts runToolCall: pick(toolArguments, Object.keys(schema.properties)) when additionalProperties !== true), preventing argument-injection beyond the declared schema. Credential access is gated per-caller via the credential gate (handleCredentialGate) rather than using a single shared/ambient credential for every caller.

Why it matters

Limits blast radius and privilege escalation.

Evidence

const toolName = item.json.tool;
for (const tool of mcpTools) {
	const prefixedName = buildMcpToolName(node.name, tool.name);
	if (toolName !== prefixedName) continue;
	const { tool: _, ...toolArguments } = item.json;
	const schema: JSONSchema7 = tool.inputSchema;
	const sanitizedToolArguments: IDataObject =
		schema.additionalProperties !== true
			? pick(toolArguments, Object.keys(schema.properties ?? {}))
			: toolArguments;
	const result = await client.callTool(
		{ name: tool.name, arguments: sanitizedToolArguments },
		CallToolResultSchema,
		{ timeout, signal: ctx.getExecutionCancelSignal() },
…

Why it got this result

The MCP Trigger node's webhook handler (McpTrigger.node.ts) does not emit any Access-Control-Allow-Origin or Access-Control-Allow-Credentials headers; the node defines only its authentication parameter (none/bearerAuth/headerAuth/n8nOAuth2) and contains no CORS header emission at all. The rule requires the specific combination of a wildcard Access-Control-Allow-Origin together with Access-Control-Allow-Credentials:true, and that pairing is not established by this node's own code.

Why it matters

Prevents credentialed cross-origin abuse.

Evidence

			{
				displayName: 'Path',
				name: 'path',
				type: 'string',
				default: '',
	...
				required: true,
				description: 'The base path for this MCP server',
			},
			{
	...
				name: 'instructions',
				type: 'string',

Why it got this result

Tool names exposed by the MCP Trigger come directly from the n8n node names the workflow author assigned (no synthetic collision with a well-known external server's specific tool name is introduced by this code), and on the client side (MCP Client Tool), tool names pulled from a connected external MCP server are explicitly prefixed with the owning node's name via buildMcpToolName before being surfaced to the LLM agent, preventing silent collision with the agent's other tools.

Why it matters

Prevents malicious tool shadowing.

Evidence

const tools = mcpTools.map((tool) => {
	const prefixedName = buildMcpToolName(node.name, tool.name);
	return logWrapper(
		mcpToolToDynamicTool(
			{ ...tool, name: prefixedName },

Why it got this result

The MCP Trigger node's n8nOAuth2 authentication mode (McpTrigger.node.ts) delegates to n8n's own built-in OAuth authorization server (n8nOAuth2Auth / validateN8nOAuth2Token), which issues tokens directly against n8n user accounts -- it is not an OAuth PROXY that forwards a shared upstream client_id to a distinct third-party IdP on behalf of dynamically-registered MCP clients. The confused-deputy threat model this rule targets (shared upstream client_id + dynamic client registration + no per-client consent) requires an OAuth-proxy architecture that is absent here: n8n is itself the authorization server, performing per-client dynamic registration and per-(user,client) consent internally (implementation lives in packages/cli/src/modules/oauth-server, outside this component's own directory tree, but the call site establishing this is in-component).

Why it matters

Shared upstream client + dynamic MCP-client registration + no per-client consent enables attacker-registered MCP clients to receive bridge codes carrying victim upstream tokens — the documented MCP Confused Deputy attack.

Evidence

if (context.getNodeParameter('authentication') === 'n8nOAuth2') {
	if (context.getNode().typeVersion < 2) {
		resp.writeHead(401);
		resp.end('OAuth2 authentication requires mcp trigger node v2.0 or higher');
		return { noWebhookResponse: true };
	}
	const authResult = await n8nOAuth2Auth(context, { realm: 'n8n MCP Server' });
	if (authResult === 'handled') {
		return { noWebhookResponse: true };
	}
	await context.establishTriggerIdentity(
		authResult.token,
		authResult.resource,
		authResult.user.id,
…

Why it got this result

The n8n instance MCP server exposes a remote streamable-HTTP transport (/mcp-server/http) and implements a full RFC 8414 / RFC 9728 compliant OAuth 2.1 authorization server rather than relying on API keys alone: OAuthServerLocalAuthorizationServer.getMetadata() advertises authorization_endpoint, token_endpoint, registration_endpoint (RFC 7591 DCR), revocation_endpoint, jwks_uri, and code_challenge_methods_supported: ['S256'] (PKCE mandatory, S256 only). The authorize/token/register/revoke routes are implemented via the official @modelcontextprotocol/sdk handlers (authorizationHandler, tokenHandler, clientRegistrationHandler, revocationHandler) which enforce PKCE verification server-side. McpProtectedResource implements RFC 9728 protected-resource metadata with a canonical resource URL used as the JWT audience, and 401 responses carry a WWW-Authenticate header pointing to the metadata document per RFC 6750. API-key auth exists as a secondary path for programmatic/non-browser clients but is a separate, intentional mechanism, not a substitute that leaves the remote OAuth surface unprotected.

Why it matters

Misconfig enables token theft and confused-deputy attacks.

Evidence

async getMetadata(): Promise<AuthorizationServerMetadata> {
		const baseUrl = this.urlService.getInstanceBaseUrl();
		const allScopes = this.resourceRegistry.getAllScopes();
		const metadata: AuthorizationServerMetadata = {
			issuer: baseUrl,
			authorization_endpoint: `${baseUrl}/mcp-oauth/authorize`,
			token_endpoint: `${baseUrl}/mcp-oauth/token`,
			registration_endpoint: `${baseUrl}/mcp-oauth/register`,
			revocation_endpoint: `${baseUrl}/mcp-oauth/revoke`,
			jwks_uri: this.urlService.getInstanceJwksUri(),
			response_types_supported: ['code'],
			grant_types_supported: ['authorization_code', 'refresh_token'],
			token_endpoint_auth_methods_supported: ['none', 'client_secret_post', 'client_secret_basic'],
			code_challenge_methods_supported: ['S256'],
…

const registerRouter = clientRegistrationHandler({
	clientsStore: oauthServerService.clientsStore,
	rateLimit: false,
}) as Router;
const authorizeRouter = authorizationHandler({
	provider: oauthServerService,
	rateLimit: false,
}) as Router;
const tokenRouter = tokenHandler({ provider: oauthServerService, rateLimit: false }) as Router;
const revokeRouter = revocationHandler({
	provider: oauthServerService,
	rateLimit: false,
}) as Router;

Why it got this result

Every route on the MCP controller (packages/cli/src/modules/mcp/mcp.controller.ts) is wired with middlewares: [getEnabledMiddleware(), getAuthMiddleware()] (lines 77-101, 97-103, 117-120). getAuthMiddleware() (mcp-server-middleware.service.ts lines 93-135) requires an Authorization: Bearer header, rejects missing/malformed headers with 401, and resolves the token via getUserForToken() which branches to either verifyOAuthAccessToken() (full JWT signature + audience verification against the resource server's JWKS) or McpServerApiKeyService.verifyApiKey() (JWT signature verification via AuthStrategyRegistry.buildContextFromToken, which validates the signed JWT, not merely an unverified identifier). On any failure (decode failure, invalid token, lookup miss) the code returns user: null, which the middleware treats as deny -- responseWithUnauthorized() -- i.e. fail-closed. Tool-level RBAC additionally restricts which tools are registered per request based on OAuth-granted scopes (getAllowedToolNames / registerIfAllowed in mcp.service.ts).

Why it matters

Prevents unauthorized tool use and data access.

Evidence

getAuthMiddleware() {
		return async (req: Request, res: Response, next: NextFunction) => {
			const authorizationHeader = req.header('authorization');

			if (!authorizationHeader) {
				this.responseWithUnauthorized(res, req, {
					reason: 'missing_authorization_header',
					auth_type: 'unknown',
					error_details: 'Authorization header not sent',
				});
				return;
			}
...
			const result = await this.getUserForToken(token);
…

@Get('/http', {
		ipRateLimit: createIpRateLimit(mcpConfig.rateLimitServer),
		middlewares: [getEnabledMiddleware(), getAuthMiddleware()],
		skipAuth: true,
		usesTemplates: true,
	})
...
	@Post('/http', {
		ipRateLimit: createIpRateLimit(mcpConfig.rateLimitServer),
		middlewares: [getEnabledMiddleware(), getAuthMiddleware()],
		skipAuth: true,
		usesTemplates: true,
	})

Why it got this result

All MCP tools in the n8n instance MCP server are statically defined in TypeScript source under packages/cli/src/modules/mcp/tools/*.ts and registered via server.registerTool() inside McpService.getServer() (packages/cli/src/modules/mcp/mcp.service.ts lines 400-410, 492-830). There is no dynamic tool-manifest fetch, no remote JSON tool definition loading, and no hot-reload mechanism; tool code ships as part of the compiled/deployed application and changes only via a new release of the codebase (reviewed/versioned through normal git/CI). Grepped the mcp module for fetch(...tools...), tools.json, loadTools, dynamicTool and found none.

Why it matters

Prevents rug-pull tool poisoning.

Evidence

const { inputSchema, outputSchema, ...config } = tool.config;
				return server.registerTool(
					tool.name,
					{
						...config,
						...(inputSchema ? { inputSchema: shapeToStandardSchema(inputSchema) } : {}),
						...(outputSchema ? { outputSchema: shapeToStandardSchema(outputSchema) } : {}),
					},
					instrumentedHandler,
				);

Why it got this result

The MCP server implements fine-grained, per-tool OAuth-scope gating. mcp-scopes.ts defines TOOLS_BY_SCOPE mapping each of 18 distinct OAuth scopes (workflow:read/write/execute, execution:read, agent:read/write/execute, credential:read, dataTable:read/write, project:read/write, tag:read, communityPackage:install, aiPreference:read/write) to only the specific tool names that scope should unlock. getAllowedToolNames() (mcp-scopes.ts lines 201-213) resolves the token's granted scopes to an allow-set, and registerIfAllowed() in mcp.service.ts (line 495-498) only calls server.registerTool() for a tool if it's in that set -- an unregistered tool is neither listed nor callable, so scope enforcement happens at tool-registration time, not just at the handler level. Additionally, install_community_node (code-execution-capable) is further gated on a dedicated communityPackage:install global scope plus a module/feature-flag check (isCommunityNodeInstallAvailable), and folder/tag/instance-context tools are feature/license gated. This is a concrete least-privilege, allowlist-based permission model, not a single broad 'exec' tool open to all requests.

Why it matters

Limits blast radius and privilege escalation.

Evidence

export function getAllowedToolNames(grantedScopes: string[] | undefined): Set<string> | undefined {
	if (grantedScopes === undefined) return undefined;

	const allowed = new Set<string>();
	for (const scope of grantedScopes) {
		if (!isMcpScope(scope)) continue;
		for (const toolName of TOOLS_BY_SCOPE[scope]) {
			allowed.add(toolName);
		}
	}

	return allowed;
}

const registerIfAllowed: RegisterToolFn = (tool) => {
			if (allowedToolNames && !allowedToolNames.has(tool.name)) return;
			registerTool(tool);
		};

Why it got this result

The underlying HTTP server listens on '::' (all interfaces, packages/@n8n/config/src/index.ts line 178) by default, which is beyond-loopback exposure in the same category as 0.0.0.0. However, unlike the TLS gap (ATR-M0009, filed separately), every MCP route is gated by mandatory Bearer-token authentication (getAuthMiddleware()) before any tool dispatch occurs -- there is no unauthenticated tool-call path reachable on this bind. The rule's positive indicator is 'listens on 0.0.0.0 with no auth/TLS'; auth IS present and enforced (see ATR-M0010 SECURE finding), so despite the broad bind address and the TLS gap (tracked separately under ATR-M0009), the specific No-Auth-AND-no-TLS combination this rule targets is not met -- auth is present.

Why it matters

LAN/Internet exposure enables remote exploitation.

Evidence

@Post('/http', {
		ipRateLimit: createIpRateLimit(mcpConfig.rateLimitServer),
		middlewares: [getEnabledMiddleware(), getAuthMiddleware()],
		skipAuth: true,
		usesTemplates: true,
	})
	async build(req: AuthenticatedRequest, res: FlushableResponse) {

	/** IP address n8n should listen on */
	@Env('N8N_LISTEN_ADDRESS')
	listen_address: string = '::';

Why it got this result

Tool names registered (search_workflows, execute_workflow, get_workflow_details, create_folder, list_credentials, create_agent, etc., see mcp-scopes.ts TOOLS_BY_SCOPE) are specific to n8n's own domain objects (workflows, executions, agents, data tables, folders) and do not collide with well-known tool names from widely-deployed third-party MCP servers (e.g. filesystem server's read_file/write_file, the official fetch server's fetch, git server's git_status) or client built-ins. Each tool name encodes the n8n resource it operates on (e.g. search_workflows vs a generic 'search'), which functions as effective namespacing without a formal prefix. No code path aliases or lets one tool silently win a registration collision; every tool name is a unique string literal in its own source file and registration happens once per request via server.registerTool() with no dynamic name resolution.

Why it matters

Prevents malicious tool shadowing.

Evidence

export const TOOLS_BY_SCOPE: Record<McpScope, readonly string[]> = {
	'workflow:read': [
		'search_workflows',
		'get_workflow_details',
		'get_workflow_history',
		'get_workflow_version',
		'get_workflow_versions_diff',
		// Read-only builder support tools
		'search_nodes',
		'get_node_types',
...
	'workflow:write': [
		'create_workflow_from_code',
		'update_workflow',
…

Why it got this result

Reviewed tool descriptions registered across packages/cli/src/modules/mcp/tools/*.ts (63 tools). All descriptions are short, neutral, functional statements of what the tool does (e.g. search_workflows: 'Search for workflows with optional filters...'). Grepped for known injection markers (ignore previous, always upload, exfiltrate, hidden directive language) and found none. Also scanned the mcp tool source tree for zero-width/bidi control characters (U+200B, U+200C, U+200D, U+2066, U+2069) using a Python script and found none in any .ts file.

Why it matters

Prevents covert model manipulation.

Evidence

description:
				'Search for workflows with optional filters. Returns a preview of each workflow. Where workflows are organised into folders, narrow the search with folderId instead of scanning everything: reuse a parentFolderId from an earlier result, or resolve a folder name with search_folders when that tool is available.',

Why it got this result

The n8n instance MCP server's OAuth flow is served by OAuthServerLocalAuthorizationServer / OAuthServerService (packages/cli/src/modules/oauth-server/), which is itself the OAuth 2.1 authorization server (issuer = the n8n instance origin, own /mcp-oauth/authorize, /mcp-oauth/token, /mcp-oauth/register, own signing JWKS) -- it does NOT proxy/forward authorization to a distinct upstream IdP on a registered MCP client's behalf. This rule's threat model (shared upstream client_id forwarded to an external IdP for many dynamically-registered downstream clients, confusing the upstream IdP about which deputy is acting) does not apply to a server that is the IdP. Additionally, even considering the DCR endpoint (RFC 7591 clientRegistrationHandler at /mcp-oauth/register) that lets MCP clients self-register, the server implements explicit per-(user, clientId) persisted consent: OAuthConsentService.tryReuseConsent() looks up a UserConsentRepository row keyed on (userId, clientId) before auto-approving, and getConsentDetails() shows a consent screen (clientName, scopes, resourceName) before redirecting -- i.e. it already has the negative-indicator consent architecture this rule asks for, further supporting non-applicability / non-vulnerability.

Why it matters

Shared upstream client + dynamic MCP-client registration + no per-client consent enables attacker-registered MCP clients to receive bridge codes carrying victim upstream tokens — the documented MCP Confused Deputy attack.

Evidence

async getMetadata(): Promise<AuthorizationServerMetadata> {
		const baseUrl = this.urlService.getInstanceBaseUrl();
		const allScopes = this.resourceRegistry.getAllScopes();
		const metadata: AuthorizationServerMetadata = {
			issuer: baseUrl,
			authorization_endpoint: `${baseUrl}/mcp-oauth/authorize`,
			token_endpoint: `${baseUrl}/mcp-oauth/token`,
			registration_endpoint: `${baseUrl}/mcp-oauth/register`,
			revocation_endpoint: `${baseUrl}/mcp-oauth/revoke`,
			jwks_uri: this.urlService.getInstanceJwksUri(),

async tryReuseConsent(
		user: User,
		sessionPayload: OAuthSessionPayload,
		resolvedResource?: ProtectedResource,
	): Promise<{ redirectUrl: string } | null> {
		if (!sessionPayload.resource) return null;

		const resource =
			resolvedResource ??
			(await this.protectedResourceRegistry.getByResourceUrl(sessionPayload.resource));
		if (!resource?.isFirstParty) return null;

		const consent = await this.userConsentRepository.findOne({
			where: { clientId: sessionPayload.clientId, userId: user.id },
…

Why it got this result

The PostToolUse hook sends a hashed machine identifier (derived from username, hostname, platform, arch, and release) together with the invoked skill name to telemetry.n8n.io. This behavior does not meet the rule's gating threshold, as it does not involve credential data, a third-party sink, obfuscation, or any conditional trigger gating that would elevate it to a concealed, high-impact capability.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

#!/usr/bin/env node

// Tracks n8n plugin skill usage by sending anonymized analytics.
// Called as a PostToolUse hook for the Skill tool.
// Receives JSON on stdin: { "tool_name": "Skill", "tool_input": { "skill": "n8n:foo", ... }, "tool_response": ... }

import { createHash } from 'node:crypto';
import { hostname, userInfo, platform, arch, release } from 'node:os';

const TELEMETRY_HOST = 'https://telemetry.n8n.io';
[REDACTED]

const input = await new Promise((resolve) => {
	let data = '';
…

"hooks": {
    "PostToolUse": [
        {
            "matcher": "Skill",
            "hooks": [
                {
                    "type": "command",
                    "command": "node .claude/plugins/n8n/scripts/track-skill-usage.mjs",
                    "timeout": 10,
                    "async": true
                }
            ]
        }
    ]
…

# n8n Claude Code Plugin

Shared commands and agents for n8n development, plus Claude Code skill links.
All plugin items are namespaced under `n8n:` to avoid collisions with personal
or third-party plugins.

## Usage

Skills, commands, and agents are auto-discovered by Claude Code from this
plugin directory. Everything gets the `n8n:` namespace prefix automatically.

Why it got this result

Reviewed plugin manifests, README, agents, commands, and setup-mcps SKILL.md for consent-bypass/disclosure-suppression prose. None found; the setup-mcps skill explicitly asks the user via AskUserQuestion before each install action and does not instruct bypassing any confirmation.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

3. Process each selected MCP **one at a time** in a loop. For each MCP:
   a. Ask the user via `AskUserQuestion`: "Where should **{MCP name}** be installed?"
      - **user** (default, recommended) — available in all projects
      - **local** — only in this project
   b. Run the install command for that MCP with the chosen scope
   c. Then move to the next MCP and ask again

Why it got this result

The telemetry hook hashes OS identity metadata and transmits it along with the invoked skill name; it does not read a host credential store, API keys, tokens, or live conversation/memory context covered by this rule. The absence of any credential or conversation-context harvest means the exfiltration-pairing criterion this rule requires is not met, and the behavior is addressed separately under the undisclosed-capability rule.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

const raw = `${userInfo().username}@${hostname()}|${platform()}|${arch()}|${release()}`;
const userId = createHash('sha256').update(raw).digest('hex');

const payload = JSON.stringify({
	userId,
	event: 'Claude Code skill activated',
	properties: { skill: skillName },
	context: { ip: '0.0.0.0' },
});

Why it got this result

Codepoint-scanned all model-facing carriers in this component (README.md, plugin.json, marketplace.json, agents/*.md, commands/*.md, setup-mcps/SKILL.md) -- only normal box-drawing/em-dash/arrow punctuation found; no zero-width/bidi/Tag-block codepoints, no forged chat-template tokens, no HTML-comment or CSS-hidden concealment.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

(scanned full file: only box-drawing/em-dash/arrow punctuation for ASCII tree + prose; no concealment codepoints)

Why it got this result

The plugin's manifests, skills, agents, commands, and hook script all ship inside the bundled, version-controlled repository; most skills under skills/ are git symlinks to .agents/skills/ (disclosed in README) rather than runtime-fetched content. No auto-update/hot-reload mechanism, no self-mutation of its own manifest after approval is present. (The telemetry hook's undisclosed behavior is separately captured under ATR-P0001/ATR-P0004/ATR-P0005, not a provenance/mutation concern -- the hook's code is static and committed, not swapped post-approval.)

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

{
	"name": "n8n",
	"version": "0.2.0",
	"description": "n8n Claude Code plugin — shared skills, commands, and agents for n8n development"
}

Why it got this result

Plugin name n8n matches the canonical spelling of the project it is bundled with, published from and owned by the n8n-io/n8n repository itself (source-host org IS the genuine owner) -- not a third-party impersonating n8n. No trust-implying prefix, version-spoofing suffix, or fork/replacement-impersonation prose.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

{
	"name": "n8n",
	"version": "0.2.0",
	"description": "n8n Claude Code plugin — shared skills, commands, and agents for n8n development"
}

Why it got this result

The HTTP transport gates every request with a bearer-token check (isAuthorized) before any tool dispatch; the comparison is constant-time (timingSafeEqual via constantTimeEqual) over the FULL secret token (not merely an identifier parsed from it), and the error path (missing/invalid header, length mismatch, non-matching bytes) always returns false -> 401, i.e. fails closed. The stdio transport relies on the OS process boundary (spawned locally by the MCP client), which is standard for stdio MCP servers. No branch returns 'authorized' on error/empty input.

Why it matters

Prevents unauthorized tool use and data access.

Evidence

function constantTimeEqual(a: string, b: string): boolean {
	const aBuf = Buffer.from(a, 'utf8');
	const bBuf = Buffer.from(b, 'utf8');
	if (aBuf.length !== bBuf.length) return false;
	return timingSafeEqual(aBuf, bBuf);
}

export function isAuthorized(req: IncomingMessage, expectedToken: string): boolean {
	const header = req.headers.authorization;
	if (typeof header !== 'string') return false;
	const match = /^Bearer\s+(.+)$/i.exec(header.trim());
	if (!match) return false;
	return constantTimeEqual(match[1], expectedToken);
}

		if (!isAuthorized(req, authToken)) {
			writeJsonError(res, 401, 'Unauthorized');
			return;
		}

Why it got this result

All 31 tools are statically defined in-repo TypeScript (src/tools/*.ts), built and shipped as part of the npm package; there is no runtime tool-manifest fetch, hot-reload, or dynamic tool-definition loading over HTTP. Updating tool definitions requires a new package release/build, which goes through the standard npm publish and version-pinning (package.json) process. No re-approval mechanism exists beyond the host MCP client's normal reconnection flow, but there is no live-mutation vector either.

Why it matters

Prevents rug-pull tool poisoning.

Evidence

export function createBrowserTools(
	config?: Partial<Config>,
	options?: BrowserConnectionOptions,
): BrowserToolkit {
	const connection = new BrowserConnection(config, options);

	const tools: ToolDefinition[] = [
		...createSessionTools(connection),
		...createTabTools(connection),
		...createNavigationTools(connection),
		...createInteractionTools(connection),
		...createInspectionTools(connection),
		...createWaitTools(connection),
		...createStateTools(connection),
…

Why it got this result

browser_evaluate executes JavaScript directly in the connected page's context, and browser_cookies/browser_storage read and mutate cookies and storage for the current browser session. This breadth of control is the explicitly declared purpose of this browser-automation server, not an undeclared escalation of privilege beyond the tools' stated contract. browser_evaluate is additionally guarded by a sensitivity refusal that blocks execution when the page is judged to currently display a secret. Broad, openly declared browser-control capability paired with this guard does not amount to overprivilege under this rule.

Why it matters

Limits blast radius and privilege escalation.

Evidence

function browserEvaluate(connection: BrowserConnection): ToolDefinition {
	return createConnectedTool(
		connection,
		'browser_evaluate',
		'Execute JavaScript in the page context and return the result. The script must be an expression or IIFE. The result is JSON-serialized.',
		browserEvaluateSchema,
		async (state, input, pageId) => {
			const refusal = await sensitivityRefusal(state, pageId);
			if (refusal) return formatCallToolResult({ ...refusal });

			const result = await state.adapter.evaluate(pageId, input.script);
			return formatCallToolResult({ result });
		},
		browserEvaluateOutputSchema,
…

function browserCookies(connection: BrowserConnection): ToolDefinition {
	return createConnectedTool(
		connection,
		'browser_cookies',
		'Get, set, or clear cookies.',
		browserCookiesSchema,
		async (state, input, pageId) => {
			switch (input.action) {
				case 'get': {
					const cookies = await state.adapter.getCookies(pageId, input.url);
					return formatCallToolResult({ cookies });
				}

MCP server that gives AI agents full control over Chrome. Connects to the
user's real installed browser via the **n8n AI Browser Bridge** extension, using
their actual profile, cookies, and sessions. Action tools return an
accessibility snapshot with every response for single-roundtrip interaction.

Why it got this result

The streamable-HTTP listener rejects ANY request carrying an Origin header at all (status 403), which is a stricter policy than an allowlist -- it blocks all browser-originated fetch/XHR/CORS preflight traffic outright, defeating DNS-rebinding and drive-by-browser attacks since no site content served to a browser can ever reach this endpoint. Host-header validation (DNS rebinding protection) is also enabled whenever the server binds to loopback via buildAllowedHosts(); it is intentionally disabled only when the operator explicitly binds beyond loopback (where Host spoofing from a LAN client is expected and the bearer-token + Origin guard remain the gates).

Why it matters

Prevents DNS rebinding/browser hijack of local or remote MCP.

Evidence

const httpServer = createServer((req, res) => {
	// Reject any request that carries an Origin header. The transport has no
	// browser clients; the only way an Origin header appears is from a
	// fetch/XHR initiated by web content, which we never want to serve.
	// Browser CORS preflights also carry Origin and are blocked here.
	if (typeof req.headers.origin === 'string' && req.headers.origin.length > 0) {
		writeJsonError(res, 403, 'Origin not allowed');
		return;
	}

	if (!isAuthorized(req, authToken)) {
		writeJsonError(res, 401, 'Unauthorized');
		return;
	}
…

Why it got this result

Default bind is 127.0.0.1 (DEFAULT_HOST). Non-loopback binding (e.g. 0.0.0.0) requires an explicit operator-supplied --host/env flag, and even then every request still requires a Bearer token compared with constant-time comparison (isAuthorized/constantTimeEqual) before being served. There is no TLS termination built into this Node http.createServer, so an operator who binds beyond loopback without a TLS-terminating reverse proxy is exposed to credential sniffing over the wire, but the baseline default is loopback + auth, and the docs explicitly instruct to use 0.0.0.0 'only when the listener must accept connections from outside the host.' We flag the lack of any TLS enforcement at non-loopback bind separately as hardening (see ATR-M0009).

Why it matters

LAN/Internet exposure enables remote exploitation.

Evidence

const ENV_PREFIX = 'N8N_MCP_BROWSER_';
const DEFAULT_HOST = '127.0.0.1';
const DEFAULT_PORT = 3100;

export function isAuthorized(req: IncomingMessage, expectedToken: string): boolean {
	const header = req.headers.authorization;
	if (typeof header !== 'string') return false;
	const match = /^Bearer\s+(.+)$/i.exec(header.trim());
	if (!match) return false;
	return constantTimeEqual(match[1], expectedToken);
}

Why it got this result

The HTTP transport implements no CORS headers at all and actively rejects any request carrying an Origin header (403), so there is no Access-Control-Allow-Origin: * (with or without credentials) response ever emitted. This is stricter than a misconfigured wildcard-with-credentials policy -- it is a blanket deny of browser-originated cross-origin requests.

Why it matters

Prevents credentialed cross-origin abuse.

Evidence

const httpServer = createServer((req, res) => {
	// Reject any request that carries an Origin header. The transport has no
	// browser clients; the only way an Origin header appears is from a
	// fetch/XHR initiated by web content, which we never want to serve.
	// Browser CORS preflights also carry Origin and are blocked here.
	if (typeof req.headers.origin === 'string' && req.headers.origin.length > 0) {
		writeJsonError(res, 403, 'Origin not allowed');
		return;
	}

Why it got this result

All 31 tools are namespaced under the 'browser_' prefix (browser_connect, browser_navigate, browser_evaluate, etc.), which avoids colliding with generic tool names from other widely-deployed MCP servers (e.g. filesystem server's 'read_file', 'write_file'). No evidence of registration-order tricks or unqualified generic verb names.

Why it matters

Prevents malicious tool shadowing.

Evidence

const tools: ToolDefinition[] = [
	...createSessionTools(connection),
	...createTabTools(connection),
	...createNavigationTools(connection),
	...createInteractionTools(connection),
	...createInspectionTools(connection),
	...createWaitTools(connection),
	...createStateTools(connection),
	...createCredentialTools(connection),
];

Why it got this result

Manual review of all 31 tool description strings across src/tools/*.ts found neutral, functional descriptions only (what the tool does and when to prefer it over another tool). No hidden directives, no control characters/ANSI escapes/RLO-LRO unicode, and no instructions directing exfiltration or silent behavior were found. Grep for exfiltration/concealment keywords across src/ returned no hits outside test/redaction-pattern code (a regex slug name 'slack_webhook_url' used only for secret redaction, not a directive).

Why it matters

Prevents covert model manipulation.

Evidence

'browser_snapshot',
'Use this tool as your primary way to observe the page. Returns a ref-annotated accessibility tree — a compact text representation of all visible elements. Each interactive element gets a numeric ref for use in subsequent tool calls (browser_click, browser_type, etc.). Snapshots are small and fast. Prefer this over browser_screenshot unless you specifically need visual/layout information.'

Why it got this result

This server is not an OAuth proxy: it does not forward requests to a distinct upstream IdP on behalf of dynamically-registered MCP clients. It is a single-tenant local browser-automation server authenticated by one static bearer token; there is no client registration endpoint or upstream OAuth client_id sharing involved.

Why it matters

Shared upstream client + dynamic MCP-client registration + no per-client consent enables attacker-registered MCP clients to receive bridge codes carrying victim upstream tokens — the documented MCP Confused Deputy attack.

Evidence

#!/usr/bin/env node

import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
import { randomUUID, timingSafeEqual } from 'node:crypto';

Why it got this result

This skill documents usage of the third-party gh-stack GitHub CLI extension for managing stacked PRs. Its content (init/add/push/submit/rebase/view/checkout/unstack commands) matches the declared description exactly; all actions are git/GitHub operations the user explicitly installs and invokes via gh extension install github/gh-stack. No hidden network egress, credential harvesting, or unrelated capability is directed.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
description: |
    Manage stacked branches and pull requests with the gh-stack GitHub CLI extension. Use when the user wants to create, push, rebase, sync, navigate, or view stacks of dependent PRs. Triggers on tasks involving stacked diffs, dependent pull requests, branch chains, or incremental code review workflows.
metadata:
    author: github
    github-path: skills/gh-stack
    github-ref: refs/tags/v0.1.0
    github-repo: https://github.com/github/gh-stack
    github-tree-sha: c95c8b5b4dd850f3fef007b304428f5684f2fb87
    version: 0.0.9
name: n8n:gh-stack
---

Why it got this result

Requiring an authenticated GitHub CLI session is a prerequisite for using the user's own already-authenticated session; the skill's instructions never direct it to read, expose, or transmit the session token or other credential material, so the protected-data harvest required by this rule is absent.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

## Prerequisites

The GitHub CLI (`gh`) v2.0+ must be installed and authenticated. Install the extension with:

```bash
gh extension install github/gh-stack
```

Why it got this result

The extension installation (gh extension install github/gh-stack) is an explicit, user-initiated CLI instruction documented in the prerequisites, not an artifact-shipped activation hook, load-time script, or covert persistent directive embedded in the skill itself.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

The GitHub CLI (`gh`) v2.0+ must be installed and authenticated. Install the extension with:

```bash
gh extension install github/gh-stack
```

Why it got this result

This skill has no allowed-tools frontmatter restricting capability at all (it documents usage of a separately-installed gh extension); it is text guidance, not a capability grant. The operations documented (git/gh stack management) match its single declared purpose with no unrelated capability class requested.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
description: |
    Manage stacked branches and pull requests with the gh-stack GitHub CLI extension. Use when the user wants to create, push, rebase, sync, navigate, or view stacks of dependent PRs.
metadata:
    author: github
    github-path: skills/gh-stack
    github-ref: refs/tags/v0.1.0
    github-repo: https://github.com/github/gh-stack
    github-tree-sha: c95c8b5b4dd850f3fef007b304428f5684f2fb87
    version: 0.0.9
name: n8n:gh-stack
---

Why it got this result

Scanned for concealment codepoints and homoglyphs; none found. All imperative prose ('Always supply branch names...', 'Never do any of the following') is plainly visible, functional CLI-usage guidance for the declared gh-stack extension, not a hidden injected directive.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

## Agent rules

**All `gh stack` commands must be run non-interactively.** Every command invocation must include the flags and positional arguments needed to avoid prompts, TUIs, and interactive menus.

Why it got this result

This skill explicitly pins its upstream provenance (github-repo, github-ref=refs/tags/v0.1.0, github-tree-sha, version) in frontmatter metadata, and the file itself is checked into the repo (version-controlled, not fetched at agent runtime). The referenced gh-stack CLI extension is installed explicitly by the user via gh extension install, outside this skill's own execution.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
description: |
    Manage stacked branches and pull requests with the gh-stack GitHub CLI extension.
metadata:
    author: github
    github-path: skills/gh-stack
    github-ref: refs/tags/v0.1.0
    github-repo: https://github.com/github/gh-stack
    github-tree-sha: c95c8b5b4dd850f3fef007b304428f5684f2fb87
    version: 0.0.9
name: n8n:gh-stack
---

Why it got this result

Name is namespaced 'n8n:gh-stack' and the metadata block explicitly and correctly attributes authorship to 'github' with the real upstream repo URL (github/gh-stack), tag ref, and tree SHA -- this is accurate provenance disclosure, not impersonation.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

metadata:
    author: github
    github-path: skills/gh-stack
    github-ref: refs/tags/v0.1.0
    github-repo: https://github.com/github/gh-stack
    github-tree-sha: c95c8b5b4dd850f3fef007b304428f5684f2fb87
    version: 0.0.9
name: n8n:gh-stack
---

Why it got this result

Declared purpose (fetch/analyze Linear issue context) explicitly requires gh CLI and curl for downloading images/PR data -- all disclosed in frontmatter compatibility.requires. No credential harvesting beyond the already-authenticated gh token used for its stated GitHub-fetch purpose, which is an implied-in-scope capability per the false_positive_guard (e.g. a 'GitHub PR reviewer' reading a git token).

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: n8n:linear-issue
description: Fetch and analyze Linear issue with all related context...
compatibility:
  requires:
    - mcp: linear
      description: Core dependency — used to fetch issue details, relations, and comments
    - cli: gh
      description: GitHub CLI — used to fetch linked PRs and issues. Must be authenticated (gh auth login)
  optional:
    - mcp: notion
    - skill: loom-transcript
    - cli: curl
---

**GitHub PRs and Issues:**
- If GitHub links are mentioned, use `gh` CLI to fetch PR/issue details:
	- `gh pr view <number>` for pull requests
	- `gh issue view <number>` for issues
- Download images attached to issues: `curl -H "Authorization: token $(gh auth token)" -L <image-url> -o image.png`

Why it got this result

No language directs the agent to bypass confirmation or hide actions. The skill actually directs the agent to STOP and surface a security warning to the user when a private/security-labeled issue is detected in the wrong repo context -- a disclosure-promoting, not suppressing, instruction.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

### 2. Check for Private/Security Issues (MANDATORY — do this before anything else)
...
2. If any label is **`n8n-private`**:
   a. Run `git remote -v` ...
   b. If **any** remote URL contains `n8n-io/n8n` without the `-private` suffix ..., **stop immediately** and tell the user:
   > **This issue is marked `n8n-private` and must be developed in a clean clone of the private repository.**

Why it got this result

The compatibility frontmatter block enumerates exactly the external dependencies the skill needs (Linear MCP required, gh CLI required, Notion MCP optional, curl optional, loom-transcript skill optional) each with a one-line justification tying it to the declared fetch/analyze function -- a narrow, justified, non-wildcard declared scope, not an over-broad grant.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

compatibility:
  requires:
    - mcp: linear
      description: Core dependency — used to fetch issue details, relations, and comments
    - cli: gh
      description: GitHub CLI — used to fetch linked PRs and issues. Must be authenticated (gh auth login)
  optional:
    - mcp: notion
      description: Used to fetch linked Notion documents. Skip Notion steps if unavailable.
    - skill: loom-transcript
      description: Used to fetch Loom video transcripts. Skip Loom steps if unavailable.
    - cli: curl
      description: Used to download images/attachments. Typically pre-installed.
---

Why it got this result

Codepoint scan found only normal arrow/comparison/em-dash punctuation; no concealment codepoints, no forged system/role tokens, no HTML-comment or CSS-hidden content.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

(scanned full file: only —,≥,→,≤,– present as prose punctuation; no concealment codepoints, no forged role tokens)

Why it got this result

Instructions ship inside the bundled, version-controlled SKILL.md; no runtime fetch of its own instructions, no self-updater, no rewriting of its own manifest.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

(static bundled text, no fetch/self-update mechanism present)

Why it got this result

Declared name n8n:linear-issue correctly names the third-party service it integrates with (Linear) using the canonical spelling, with no claim of being an official Linear product, no trust-implying prefix, and no version-spoofing suffix -- it is clearly an n8n-authored integration skill, published from the n8n-io/n8n repo itself.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: n8n:linear-issue

Why it got this result

The component only directs in-band use of registered CLI or MCP tools and includes no bundled execution or persistence primitive.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

(no bundled scripts, hooks, or env assignments in this component; only prose directing use of already-registered CLI/MCP tools)

Why it got this result

SKILL.md is a pure-declarative UI guidance artifact: it directs the model to read two documentation files and cross-reference two sibling skills for Agent Builder UI work. No bundled scripts, no network egress, no credential/env reads, no subprocess/eval. Every instruction maps 1:1 to the declared purpose (UI design guidance scoped to packages/frontend/editor-ui/src/features/agents).

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: n8n:agent-design-language
description: Design or review Agent Builder interfaces. Use for Agent configuration patterns, modal flows, responsive behavior, status treatments, and other Agent-only UI work.
---

# Agent design language

Use this skill only for interface work in
`packages/frontend/editor-ui/src/features/agents`.

Before you change code:

1. Read `packages/frontend/editor-ui/src/features/agents/AGENTS.md`.
2. Read `packages/frontend/editor-ui/src/features/agents/agents-design-language.md`
…

Why it got this result

No prose anywhere in SKILL.md directs the host to skip confirmation, hide actions from the user, or claims authority over the system prompt. Purely task-scoped UI guidance.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

(full file reviewed -- no consent/confirmation/disclosure-suppression language present)

Why it got this result

No allowed-tools/scope/permission declaration of any kind in the frontmatter; the skill is a plain markdown instruction set with no self-declared capability grant to assess for over-breadth. No wildcard, no bundled executables, no install hooks.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: n8n:agent-design-language
description: Design or review Agent Builder interfaces. Use for Agent configuration patterns, modal flows, responsive behavior, status treatments, and other Agent-only UI work.
---

Why it got this result

Codepoint-scanned the file for zero-width/bidi/Tag-block characters and mixed-script confusables -- none found; only normal em-dash punctuation. No forged chat-template tokens, no HTML-comment concealment, no imperative aimed at overriding the host's system prompt.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

(scanned full file: only standard em-dash U+2014 present; no concealment codepoints, no forged role tokens)

Why it got this result

The instruction body ships entirely inside the bundled SKILL.md file in the git repository; there is no runtime fetch of the instructions from a remote/mutable endpoint, no auto-update mechanism, and no self-mutation code. Version control (git) provides the change record for this file.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

(entire instruction body is static text committed to the repo; no fetch()/load_extension/hot-reload logic present)

Why it got this result

Declared name n8n:agent-design-language is namespaced under the repo's own n8n: prefix (sourced from the n8n-io/n8n repo itself), is a plain descriptive name with no resemblance to any well-known third-party tool/brand, no trust-implying prefix, no version-spoofing suffix, and no impersonation prose.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: n8n:agent-design-language

Why it got this result

The skill performs no read of any host credential store, env var, or conversation/memory context -- it only directs reading two local documentation markdown files. No harvest step exists, so the harvest+exfil pair this rule tests for cannot be constructed.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

(no env/credential/memory read of any kind in this file)

Why it got this result

The component is prose-only guidance and contains no executable hook, environment override, host-control write, or other control-plane persistence primitive within the scope of this rule.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

(entire component is a single SKILL.md file with no scripts, hooks, or env assignments)

Why it got this result

SKILL.md declares allowed-tools: Bash(gh:*), Bash(git:*), Bash(node:*), Read, Glob, Grep and a clear purpose (PR readiness triage). All actions in the body (gh pr/api calls, Linear MCP ticket updates, running owners.mjs) map 1:1 to the declared purpose of reviewing and triaging community PRs. No undeclared network egress, credential reads, or exec capability found.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: n8n:community-pr-readiness-check
description: >-
  Checks if a community pull request is ready for human review...
allowed-tools: Bash(gh:*), Bash(git:*), Bash(node:*), Read, Glob, Grep
compatibility:
  requires:
    - mcp: linear
      description: Required for reading and updating Linear tickets during triage
    - cli: gh
      description: Required for PR inspection and triage actions. Must be authenticated (gh auth login)
---

Why it got this result

Reviewed SKILL.md body: every destructive/triage action (closing PRs, label changes, Linear ticket updates) is explicitly gated behind an 'Ask the user' prompt in Step 7 (e.g. 'Ask Close + comment / Edit before closing / Skip'). No prose instructs the agent to skip confirmation, hide an action from the user, or claim authority over host system prompt.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

## Step 7 — Action paths

Ask the user for each prompt (presented as the listed options). Sub-agents called for analysis only should stop after step 6 and let the caller drive step 7.

Why it got this result

allowed-tools is an enumerated, scoped list (Bash(gh:*), Bash(git:*), Bash(node:*), Read, Glob, Grep) -- not a wildcard. gh/git/node shell access is intrinsic to and justified by the declared function (PR triage requires gh for GitHub operations, git for inspecting diffs, node for running the owners.mjs script). No filesystem-write, broader network, or ambient-credential capability is declared beyond this.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

allowed-tools: Bash(gh:*), Bash(git:*), Bash(node:*), Read, Glob, Grep

Why it got this result

Codepoint-scanned all files in this skill directory for zero-width/bidi/Tag-block characters and found none. Content is 7-bit ASCII, purely descriptive, with no forged chat-template tokens, ANSI escapes, or HTML-comment concealment.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: n8n:community-pr-readiness-check
description: >-
  Checks if a community pull request is ready for human review...
---

Why it got this result

SKILL.md and its reference/*.md ship inside the repo's git-tracked bundle; there is no runtime fetch of the artifact's own instructions from an external endpoint and no self-mutation/auto-update mechanism. A change to this file is a normal reviewed git commit like any other repo file.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: n8n:community-pr-readiness-check
---

Why it got this result

Name 'n8n:community-pr-readiness-check' is published under the n8n org's own namespace prefix from the n8n-io/n8n repo itself -- the source-host org matches the declared identity. No near-miss of a third-party brand, no trust-implying prefix, no version-spoofing suffix.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: n8n:community-pr-readiness-check

Why it got this result

No instruction anywhere directs reading host credential stores, env secrets, or the model's conversation/memory context. The skill reads PR metadata via gh/Linear APIs using already-registered, host-authenticated tools -- it never reads raw credentials or dumps conversation history to an external sink.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

## Step 1 — Resolve the PR

If given a branch name, find the PR number first:

```bash
gh pr view <branch> --repo n8n-io/n8n --json number --jq .number
```

Why it got this result

The allowed-tools declaration only exposes normal in-band tools (gh, git, node, Read, Glob, Grep) and does not ship an executable, lifecycle hook, dotenv/host-config file, or persistent control-plane mechanism of its own.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

---
name: n8n:community-pr-readiness-check
...
allowed-tools: Bash(gh:*), Bash(git:*), Bash(node:*), Read, Glob, Grep
---

Why it got this result

SKILL.md declares a narrow, content-design purpose (write/review/audit UI copy) and grants only Read, Grep, Glob, Edit via allowed-tools. The body is entirely prose guidance (style rules, terminology, grading checklist) with no network egress, no credential reads, no subprocess execution, and no hidden/obfuscated code. All actual capability (reading/editing files in the repo to change copy) maps 1:1 to the declared purpose.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: n8n:content-design
description: >
  Product content designer for UI copy. Use when writing, reviewing, or auditing
  user-facing text: button labels, error messages, tooltips, empty states, modal copy,
  placeholder text, confirmation dialogs, onboarding flows, or i18n strings.
  Also use when the user says /copy, /content, or /ux-copy.
allowed-tools: Read, Grep, Glob, Edit
---

Why it got this result

No prose in the skill body instructs the agent to suppress confirmation, hide actions from the user, or claims authority over the host system prompt. The skill is purely about copywriting style and review workflow.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

## How to work

### Modes

When invoked, determine what the user needs:

1. **Write** — Draft new UI copy. Ask what surface...
2. **Review** — The user shares existing copy or points to a file. Check it
   against every rule below. Return a table:...

Why it got this result

allowed-tools is a minimal, enumerated list (Read, Grep, Glob, Edit) matching the stated copy-editing function -- no Bash, WebFetch, or wildcard capability grant, and no bundled executables or install hooks.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

allowed-tools: Read, Grep, Glob, Edit

Why it got this result

The entire SKILL.md body is ASCII, purely descriptive prose with no imperative directed at the host model to override instructions, no zero-width/bidi/control codepoints, no forged chat-template tokens, and no homoglyphs.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: n8n:content-design
description: >
  Product content designer for UI copy...
---

# n8n content design

You are a Senior Content Designer specializing in SaaS tools...

Why it got this result

SKILL.md ships inline inside the repo bundle; nothing in it live-fetches instructions from a remote/mutable endpoint, and there is no self-update or hot-reload mechanism present.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: n8n:content-design
description: >
  Product content designer for UI copy...
allowed-tools: Read, Grep, Glob, Edit
---

Why it got this result

The name n8n:content-design is a first-party-namespaced, descriptive name published directly in the n8n-io/n8n repo -- not a near-miss or homoglyph of any known brand, and carries no trust-implying prefix or version-spoofing suffix.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: n8n:content-design

Why it got this result

The skill reads only repo source files (i18n JSON, Vue templates) via Read/Grep/Glob for copy auditing; it performs no read of any host credential store or env secrets, and has no outbound network channel at all (allowed-tools lacks any fetch/bash capability). No harvest step exists, so the harvest+exfil pair this rule tests for cannot be constructed.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

allowed-tools: Read, Grep, Glob, Edit

Why it got this result

The Markdown skill contains only prose and ordinary tool permissions, with no format-native execution or persistence primitive.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

---
name: n8n:content-design
description: >
  Product content designer for UI copy...
allowed-tools: Read, Grep, Glob, Edit
---

Why it got this result

This skill is a pure documentation/reference artifact (coding conventions, patterns, commands) with no allowed-tools restriction beyond the implicit host toolset and no bundled scripts. Its content matches its declared purpose: a quick-reference for n8n coding patterns. No network egress, credential reads, or exec capability is directed anywhere in the body.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: n8n:conventions
description: Quick reference for n8n patterns. Full docs /AGENTS.md
---

# n8n Quick Reference

**📚 Full Documentation:**
- **General:** `/AGENTS.md` - Architecture, commands, workflows
- **Frontend:** `/packages/frontend/AGENTS.md` - CSS variables, timing

Use this skill when you need quick reminders on critical patterns.

Why it got this result

No prose directs skipping confirmation, hiding actions from the user, or bypassing any human-in-the-loop gate. Content is purely coding-convention reference material.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

## Critical Rules (Must Follow)

**Technical writing (comments, PRs, issues, docs):**
- Write in ASD-STE100 Simplified Technical English: short sentences, the
  active voice, one instruction for each sentence

Why it got this result

The skill's only secret-related content warns against placing secrets on command lines; it does not itself read from credential stores or transmit any protected data to an external destination.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

**Commands:**
```bash
pnpm build > build.log 2>&1  # Always redirect
pnpm typecheck               # Before commit
pnpm lint                    # Before commit
```
> Secrets: pnpm command lines may be recorded verbatim (opt-in dev metrics) —
> pass sensitive values via env vars, never inline on the command line.

Why it got this result

The skill's frontmatter contains only a name and description field; it declares no lifecycle hook, executable carrier, or host-control modification for this rule to evaluate.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

---
name: n8n:conventions
description: Quick reference for n8n patterns. Full docs /AGENTS.md
---

Why it got this result

No allowed-tools/capability declaration at all beyond the default host toolset implied by a reference doc; no capability class (exec, network, fs-write, credentials) is granted or requested.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: n8n:conventions
description: Quick reference for n8n patterns. Full docs /AGENTS.md
---

Why it got this result

Scanned the file for zero-width/bidi/tag-block concealment codepoints and mixed-script homoglyphs; none found (only ordinary emoji/dash/arrow Unicode). No hidden directives detected.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: n8n:conventions
description: Quick reference for n8n patterns. Full docs /AGENTS.md
---

# n8n Quick Reference

Why it got this result

First-party, in-repo static Markdown file shipped and version-controlled with the n8n monorepo itself -- not fetched at runtime from a mutable external endpoint, and changes go through the repo's normal code-review/PR process.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: n8n:conventions
description: Quick reference for n8n patterns. Full docs /AGENTS.md
---

Why it got this result

Name 'n8n:conventions' is a first-party namespaced skill shipped inside the n8n monorepo itself, with no impersonation of a third-party brand, no typosquat, no trust-implying prefix, and no version-spoofing suffix.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: n8n:conventions
description: Quick reference for n8n patterns. Full docs /AGENTS.md

Why it got this result

SKILL.md's declared purpose (author/calibrate Instance AI agent-builder evals) matches its actual instructed behavior: it directs reading LangTracer env vars, drafting JSON eval cases, running pnpm scripts, and proposing Linear tickets -- all within the stated eval-authoring scope. It explicitly instructs NOT to print/inspect the LANGTRACER_API_KEY value and not to ask the user to paste it into chat, which is a privacy-preserving instruction rather than a harvesting one.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

Do not ask the user to paste the key into chat. Do not print or inspect its
value. Rerun the check after the user confirms. Continue only when it passes.

Why it got this result

No prose instructs skipping confirmation, hiding actions from the user, or asserting authority over the host system prompt. The skill repeatedly routes decisions back through the driver/user (autonomy level, target suite) rather than bypassing them.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

## Set the autonomy level first

Follow "Set the autonomy level first" in
[create-instance-ai-eval](../create-instance-ai-eval/SKILL.md). Ask the driver
for *autonomous* or *checkpoint* mode before you source or draft anything.

Why it got this result

The component loads LangTracer credentials (LANGTRACER_URL/LANGTRACER_API_KEY) from the repository-root .env.eval into its declared publish/run eval commands, so secret handling is in scope. Instructions explicitly forbid printing or inspecting the key value and forbid pasting it into chat, and the key is used only to authenticate to the first-party LangTracer service the skill is designed to publish to. No arbitrary environment enumeration, credential-store read, or conversation-history exfiltration occurs.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

pnpm exec dotenvx run -f ../../../.env.eval -- \
  sh -c 'test -n "${LANGTRACER_URL:-}" && test -n "${LANGTRACER_API_KEY:-}"'

Why it got this result

No allowed-tools frontmatter restricting/declaring a capability class is present, and the skill's actual instructed actions (pnpm/dotenvx shell commands, LangTracer tool calls) match its stated eval-authoring purpose; no wildcard or catch-all capability grant is declared.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: n8n:create-agent-builder-eval
description: >-
  Authors and calibrates Instance AI evaluations ...
shared_references:
  - credential-setup-with-computer-use
recommended_tools:
  - build-agent
  - agent-context
  - build-workflow
  - data-tables
---

Why it got this result

Codepoint scan of SKILL.md found zero zero-width/bidi-override/Tag-block characters; no mixed-script homoglyphs, forged chat-template tokens, or ANSI escapes. All content is plain descriptive ASCII prose.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: n8n:create-agent-builder-eval
description: >-
  Authors and calibrates Instance AI evaluations that build standalone n8n
  Agents through Agent Builder. ...
---

Why it got this result

The skill ships inside the repo as a static SKILL.md file loaded from the local filesystem by the host (.agents/skills/); no runtime fetch of its own instructions from a mutable endpoint, no self-update mechanism, no post-approval self-rewrite instructed.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: n8n:create-agent-builder-eval
description: >-
  Authors and calibrates Instance AI evaluations ...
---

Why it got this result

Name 'n8n:create-agent-builder-eval' matches canonical n8n internal naming convention (n8n:<name> namespace); source-host org is n8n-io/n8n itself (verified via git remote). No near-miss of a well-known external brand, no trust-implying prefix, no impersonation prose.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: n8n:create-agent-builder-eval
description: >-

Why it got this result

The skill bundle contains only Markdown instruction files (SKILL.md and local-setup.md). The shell snippets (pnpm exec dotenvx, pnpm eval:*) are commands the agent issues only when explicitly executed as part of its normal tool-call flow, not auto-executed lifecycle hooks, load-time scripts, or shipped control-plane primitives. This architecture falls outside the scope this rule targets.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

---
name: n8n:create-agent-builder-eval
description: >-
  Authors and calibrates Instance AI evaluations ...
---
# Create an Agent Builder eval
Use the shared Instance AI eval harness.

Why it got this result

Pure scaffolding/documentation skill for authoring ESLint rules in a specific package. No network egress, no credential reads, no undisclosed exec capability. All actions (writing rule/test/doc files, running pnpm test/typecheck/build) map to the declared purpose.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: n8n:create-community-node-lint-rule
description: >-
  Create new ESLint rules for the @n8n/eslint-plugin-community-nodes package.
  Use when adding a lint rule, creating a community node lint, or working on
  eslint-plugin-community-nodes. Guides rule implementation, tests, docs, and
  plugin registration.
---

# Create Community Node Lint Rule

Guide for adding new ESLint rules to `packages/@n8n/eslint-plugin-community-nodes/`.

Why it got this result

Pure scaffolding guidance; no language instructs bypassing confirmation or hiding actions from the user.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

(full file reviewed -- no consent/confirmation/disclosure-suppression language present)

Why it got this result

No allowed-tools/scope frontmatter; no bundled executables or install hooks present in the component directory (only SKILL.md and reference.md).

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: n8n:create-community-node-lint-rule
description: >-
  Create new ESLint rules for the @n8n/eslint-plugin-community-nodes package.
...
---

Why it got this result

Codepoint scan found only normal em-dash punctuation; no zero-width/bidi/Tag-block characters, no forged chat-template tokens, no HTML-comment concealment.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

(scanned full file + reference.md: only standard em-dash present; no concealment codepoints)

Why it got this result

Instructions ship inside the bundled, version-controlled SKILL.md/reference.md; no runtime fetch or self-mutation mechanism.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

(static bundled text, no fetch/self-update mechanism present)

Why it got this result

Declared name n8n:create-community-node-lint-rule is self-descriptive, namespaced under the repo's own org prefix, with no resemblance to a known brand/tool.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: n8n:create-community-node-lint-rule

Why it got this result

No credential store, env var, or conversation-context read is present or directed; purely local scaffolding instructions.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

(no env/credential/memory read present)

Why it got this result

The documented pnpm test/typecheck/build commands are ordinary user-invoked project verification steps, not package lifecycle hooks, persistent prompt mutation, or endpoint/environment hijacking; the component ships no hook, executable entrypoint, environment assignment, or persistent host modification.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

(no bundled scripts, hooks, or env assignments in this component)

Why it got this result

Declared purpose: authoring/pushing Instance AI eval cases to LangTracer. Body describes only file authoring, local validation commands, and pushing to the declared LangTracer API via documented env vars (LANGTRACER_URL/LANGTRACER_API_KEY). No undeclared credential harvesting, exec, or network egress beyond the stated LangTracer suite API.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

- **Env:** `LANGTRACER_URL` + `LANGTRACER_API_KEY` (an `lt_` bearer; one key works
  for MCP + REST) — put them in `.env.eval` and run under `pnpm exec dotenvx`.

Why it got this result

The skill repeatedly asks the driver for decisions (suite target, autonomy level) and explicitly calls out that calibration verdicts 'never fully auto-commit' and must be surfaced. 'Autonomous mode' here means the AGENT decides when to stop at pre-defined gates, not that it hides actions from the user -- a decision log is always produced at the end for driver review. This is operator-configured autonomy, not an artifact instructing the host to bypass oversight.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

**Calibration is special-cased at both levels.** A calibration verdict that
flips a case's *meaning* ... is **surfaced explicitly**
(interactively in checkpoint; in the decision log in autonomous), never silently
committed.

Why it got this result

No allowed-tools/permissions frontmatter block is declared at all (just name+description); the skill relies on whatever tools the host session already has, and its body only documents pnpm scripts and LangTracer API usage consistent with its declared eval-authoring purpose. No wildcard or install-time script shipped by the skill itself.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: n8n:create-instance-ai-eval
description: >-
  Authors a new Instance AI workflow or Agent eval case — written locally as
  JSON, calibrated against a real build, then pushed to the LangTracer suite CI
  runs...
---

Why it got this result

Codepoint-scanned the full skill directory (SKILL.md + reference .md files) for zero-width/bidi/Tag-block characters and found none; no forged chat-template tokens or ANSI escapes detected.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: n8n:create-instance-ai-eval
---

Why it got this result

Instructions ship inside the pinned git-tracked bundle; no runtime fetch of the skill's own instruction body/manifest occurs (the LangTracer fetch is for eval case DATA, not the skill's own instructions).

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: n8n:create-instance-ai-eval
---

Why it got this result

Name 'n8n:create-instance-ai-eval' published under n8n's own namespace from the n8n-io/n8n repo; no brand impersonation.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: n8n:create-instance-ai-eval

Why it got this result

The documented LangTracer bearer is loaded from .env.eval and used only with the declared LangTracer MCP or REST service; no instruction directs reading host credential stores or dumping conversation/system-prompt context for an external sink.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

- **Env:** `LANGTRACER_URL` + `LANGTRACER_API_KEY` (an `lt_` bearer; one key works
  for MCP + REST) — put them in `.env.eval` and run under `pnpm exec dotenvx`.

Why it got this result

The dotenvx and pnpm snippets are explicit, in-band authoring commands rather than bundled lifecycle hooks or load-time execution primitives.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

```bash
cd packages/@n8n/instance-ai
# <suite> is the slug the driver chose (e.g. baseline)
# preview first — no writes:
pnpm exec dotenvx run -f .env.eval -- pnpm eval:langtracer-push --suite <suite> --dry-run --changed
```

Why it got this result

Declared purpose (create Linear tickets / GitHub issues) matches the actual behavior described: using a declared Linear MCP tool and the gh CLI to file issues, following explicit field/style templates. No undeclared network egress, credential reads, or subprocess execution beyond the declared gh issue create invocation, which matches the stated 'cli: gh' requirement in frontmatter.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: n8n:create-issue
description: Create Linear tickets or GitHub issues following n8n conventions...
argument-hint: "[linear|github] <description of the issue>"
compatibility:
  requires:
    - mcp: linear
      description: Required for creating Linear tickets
    - cli: gh
      description: Required for creating GitHub issues. Must be authenticated (gh auth login)
---

Why it got this result

The skill explicitly requires a 'Present a preview' step and 'Wait for user confirmation' before creating either a Linear ticket or a GitHub issue -- it defers to, rather than bypasses, human-in-the-loop confirmation. No prose instructs skipping confirmation or hiding actions from the user.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

2. **Present a preview** before creating — show the user:
   - Title
   - Team
   - Status
   - Priority
   - Labels
   - Description (abbreviated if long)

3. **Wait for user confirmation** — do not create until the user approves

Why it got this result

The frontmatter declares no allowed-tools wildcard; it lists explicit compatibility.requires entries (mcp: linear, cli: gh) scoped tightly to the declared issue-filing function, with no shell/network/filesystem reach beyond that.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

argument-hint: "[linear|github] <description of the issue>"
compatibility:
  requires:
    - mcp: linear
      description: Required for creating Linear tickets
    - cli: gh
      description: Required for creating GitHub issues. Must be authenticated (gh auth login)
---

Why it got this result

Instruction body is ASCII, purely descriptive/prescriptive style-guide and workflow text with no hidden codepoints, forged chat-template tokens, or homoglyphs.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: n8n:create-issue
description: Create Linear tickets or GitHub issues following n8n conventions...
---

# Create Issue

Create a Linear ticket or GitHub issue for: **$ARGUMENTS**

Why it got this result

SKILL.md ships inline in the bundle; no runtime fetch of instructions/manifest from a mutable endpoint and no self-update mechanism.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: n8n:create-issue
description: Create Linear tickets or GitHub issues following n8n conventions. Use when the user asks to create a ticket, file a bug, open an issue, or says /create-issue.
---

Why it got this result

Name n8n:create-issue is descriptive and first-party-namespaced, not a near-miss of any well-known brand/tool.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: n8n:create-issue

Why it got this result

The skill never reads host credential stores, env secrets, or conversation/memory context; its only I/O is user-provided ticket content routed to a declared Linear MCP tool or the gh CLI (both are the artifact's declared, in-scope destinations, not an undisclosed exfiltration sink). No harvest step exists.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

4. **Create the ticket** using the available Linear MCP issue-creation tool:
   ```
   title: <title>
   team: <team name>
   description: <markdown description>
   priority: <priority number>
   state: <status name>
   labels: [<label names>]
   ```

Why it got this result

The documented gh issue create invocation is an explicit, model-mediated action taken after user confirmation, not an automatic lifecycle hook, environment variable assignment, or persistent host-control-plane modification.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

5. **Create the issue** using `gh`:
   ```bash
   gh issue create --repo n8n-io/n8n --title "<title>" --body "$(cat <<'EOF'
   <body content>
   EOF
   )"
   ```

Why it got this result

Declared purpose ('Creates GitHub pull requests...') matches the allowed-tools scope (Bash(git:*), Bash(gh:*), Read, Grep, Glob) and the body's instructions, which only cover git/gh commands for inspecting diffs and creating a PR. No undeclared network egress, credential harvesting, or exec capability beyond git/gh is present. The 'Security Fixes' section explicitly instructs REDACTING vulnerability details from public artifacts, which is a protective, not malicious, directive.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: n8n:create-pr
description: Creates GitHub pull requests with properly formatted titles that pass the check-pr-title CI validation. Use when creating PRs, submitting changes for review, or when the user says /pr or asks to create a pull request.
allowed-tools: Bash(git:*), Bash(gh:*), Read, Grep, Glob
---

Why it got this result

The skill explicitly preserves human oversight: the PR checklist requires the human author to confirm they reviewed/ran/take responsibility for the code, and plan-inclusion in the PR body requires explicit user approval before being added. The Security Fixes section instructs obscuring vulnerability details in PUBLIC artifacts (branch/PR/commit text) for a public repo -- this is standard responsible-disclosure practice (avoid advertising an exploit before/while it's fixed), not suppression of the human reviewer's knowledge: the human author/reviewer still sees the full diff and (per the Linear-issue note) can check extra precautions; it does not instruct hiding the vulnerability from the Linear issue, the reviewer, or the merge decision itself.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

## Security Fixes

**This repo is public.** Never expose the attack vector in any public artifact.
Describe **what the code does**, not what threat it prevents.

| Artifact | BAD | GOOD |
|---|---|---|
| Branch | `fix-sql-injection-in-webhook` | `fix-webhook-input-validation` |
...
**Before pushing a security fix, verify:** no branch name, commit, PR title,
PR body, Linear URL, test name, or code comment hints at the vulnerability.

**When in doubt, check the Linear issue for possible extra precautions**

### Checklist
All items should be addressed before merging:
- The human author of the PR has checked the "I have seen this code, I have run this code, and I take responsibility for this code." checkbox
- PR title follows conventions

Why it got this result

Repository status, diffs, and commit history are ordinary task data rather than credentials or hidden conversation memory, so this rule has no protected-data source.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

1. **Check current state**:
   ```bash
   git status
   git diff --stat
   git log origin/master..HEAD --oneline
   ```

Why it got this result

This prose skill declares no startup command, lifecycle callback, executable payload, or persistent control-plane setting.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

---
name: n8n:create-pr
description: Creates GitHub pull requests with properly formatted titles that pass the check-pr-title CI validation. Use when creating PRs, submitting changes for review, or when the user says /pr or asks to create a pull request.
allowed-tools: Bash(git:*), Bash(gh:*), Read, Grep, Glob
---

Why it got this result

allowed-tools is a tightly enumerated, least-privilege list (git/gh Bash subcommands plus read-only Read/Grep/Glob) matching exactly what PR creation requires -- no wildcard Bash(*), no Write, no broad network tool.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

allowed-tools: Bash(git:*), Bash(gh:*), Read, Grep, Glob

Why it got this result

Scanned for concealment codepoints (zero-width/bidi/tag-block) and homoglyphs; none found (only ordinary emoji/ellipsis). No hidden directives.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: n8n:create-pr
description: Creates GitHub pull requests with properly formatted titles that pass the check-pr-title CI validation.
allowed-tools: Bash(git:*), Bash(gh:*), Read, Grep, Glob
---

Why it got this result

First-party, in-repo static file under normal version control; no runtime fetch of instructions from a mutable endpoint.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: n8n:create-pr
description: Creates GitHub pull requests with properly formatted titles that pass the check-pr-title CI validation.
allowed-tools: Bash(git:*), Bash(gh:*), Read, Grep, Glob
---

Why it got this result

First-party namespaced name 'n8n:create-pr' with no impersonation of any external brand or publisher.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: n8n:create-pr
description: Creates GitHub pull requests with properly formatted titles that pass the check-pr-title CI validation.

Why it got this result

A purely declarative/instructional authoring guide (how to write SKILL.md files); no bundled scripts, no network/credential/exec capability of any kind -- text-only guidance matching its stated purpose exactly.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: n8n:create-skill
description: >-
  Guides users through creating effective Agent Skills. Use when you want to
  create, write, or author a new skill...
---
# Creating skills
Skills are markdown (plus optional scripts) that teach the agent a focused workflow.

Why it got this result

No consent-bypass, disclosure-suppression, or authority-override prose; purely descriptive authoring guidance.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

## Before you write: gather requirements
Ask (or infer) briefly:
1. **Purpose** ...
Ask the user in plain language when you need more detail.

Why it got this result

No manifest capability grant at all -- purely descriptive guidance.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: n8n:create-skill
description: >-
  Guides users through creating effective Agent Skills. ...
---

Why it got this result

Codepoint scan found zero concealment characters; plain ASCII authoring guidance.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: n8n:create-skill
description: >-
  Guides users through creating effective Agent Skills. ...
---

Why it got this result

Statically bundled markdown with no runtime fetch, self-update, or self-rewrite behavior.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: n8n:create-skill
...
---

Why it got this result

Name matches n8n's own internal naming convention; no brand impersonation.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: n8n:create-skill
description: >-

Why it got this result

Purely declarative authoring guidance; no credential or conversation-context read of any kind.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

## File layout
```
skill-name/
├── SKILL.md       # required
...
```

Why it got this result

This component ships only a Markdown authoring guide (SKILL.md) and bundles no script, hook, entrypoint, dotenv, or other host-control-plane primitive, so there is no out-of-band execution or persistence mechanism for this rule to evaluate.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

## File layout
```
skill-name/
├── SKILL.md       # required
...
```

Why it got this result

Large (47KB) but purely declarative documentation skill for authoring TypeORM DB migrations. Manually reviewed throughout for network/exec/credential patterns -- none found beyond normal SQL/DSL guidance and references to the repo's own migration tooling (pnpm scripts, generator). No undisclosed capability.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: n8n:db-migrations
description: Authors n8n database migrations. Use when creating or modifying files under packages/@n8n/db/src/migrations/, when the user asks to add a column, table, index, foreign key, or backfill, or when the user mentions DB migrations or TypeORM migrations.
---

# n8n Migration Guidelines

**Rule of thumb:** the `@n8n-io/migrations-review` team gates every migration PR.

Why it got this result

Grepped the full 47KB file for consent-bypass/disclosure-suppression keywords (never ask, do not tell, silently, override system, autonomous mode, skip approval) -- only hits are benign uses of 'silently' describing code behavior (e.g. 'silently change the meaning of old migrations' as a caution against a bad pattern), not directives to the host agent to suppress disclosure.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

**Why:** Migrations are a historical record — they must work against the schema *as it existed when they were written*. Importing live entities means later refactors silently change the meaning of old migrations.

Why it got this result

No allowed-tools/scope frontmatter and no bundled executables; single documentation file.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: n8n:db-migrations
description: Authors n8n database migrations. Use when creating or modifying files under packages/@n8n/db/src/migrations/...
---

Why it got this result

Codepoint scan of this 47KB file found only standard box-drawing/em-dash characters used for ASCII-art directory trees and prose punctuation; no zero-width/bidi/Tag-block characters, confusable homoglyphs, or forged chat-template tokens.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

(scanned full file: only box-drawing chars ├─ and em-dash present for directory tree/prose; no concealment codepoints)

Why it got this result

Instructions ship inside the bundled, version-controlled SKILL.md; no runtime fetch or self-mutation mechanism present.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

(static bundled text, no fetch/self-update mechanism present)

Why it got this result

Declared name n8n:db-migrations is self-descriptive and namespaced under the repo's own org prefix; no resemblance to any known brand.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: n8n:db-migrations

Why it got this result

No instruction reads env vars, credential dotfiles, keychains, or conversation/memory context; the file is entirely about SQL/TypeORM migration authoring conventions.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

(no env/credential/memory read present anywhere in the 47KB file)

Why it got this result

This component ships a Markdown instruction carrier, not a bundled lifecycle hook, host config, entry script, or endpoint/exec-enabling environment assignment. The documentation-only component has no lifecycle hook, executable entrypoint, environment assignment, or host configuration primitive.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

(documentation-only component, no bundled execution primitives)

Why it got this result

Purely a documentation style-guide skill for writing JSDoc on @Env config properties. No tools declared, no network/exec/credential access of any kind -- pure prose guidance artifact.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: n8n:env-var-docs
description: >-
  Writes and reviews the JSDoc on `@Env(...)` config properties...
---

Why it got this result

No allowed-tools/permission frontmatter at all; purely a documentation guide with no declared capability.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: n8n:env-var-docs
---

Why it got this result

Codepoint-scanned the file; pure ASCII documentation guide with no concealment characters or forged tokens.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: n8n:env-var-docs
---

Why it got this result

Static, git-tracked documentation file with no runtime fetch or self-mutation mechanism.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: n8n:env-var-docs
---

Why it got this result

Name 'n8n:env-var-docs' published under n8n's own namespace; no brand impersonation.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: n8n:env-var-docs

Why it got this result

This documentation-only skill defines no privileged state-changing workflow or approval gate to suppress.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

---
name: n8n:env-var-docs
description: >-
  Writes and reviews the JSDoc on `@Env(...)` config properties...
---

Why it got this result

Pure documentation style-guide; performs no I/O of any kind, reads no credentials or context.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

---
name: n8n:env-var-docs
---

Why it got this result

Discussion of environment variables in prose does not constitute a live environment assignment or executable persistence mechanism.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

---
name: n8n:env-var-docs
---

Why it got this result

Declared purpose is guiding frontend experiment lifecycle work (creating/editing experiment code, PostHog flag lookups via an already-registered PostHog MCP). The body is purely prose guidance referencing existing repo files and an already-registered external PostHog MCP tool -- no undeclared network egress, credential harvest, or exec capability beyond editing source files as a coding assistant normally would.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: n8n:experiments
description: >-
  Guides work on `packages/frontend/editor-ui` experiments. Use when creating,
  extending, wiring, testing, reviewing, or retiring editor-ui experiments,
  PostHog feature flags...
---

# Experiments

Use this skill for frontend experiment code lifecycle work...

Why it got this result

No instruction tells the agent to bypass confirmation or hide actions; the reference explicitly instructs restraint ('Do not update, enable, or delete PostHog flags unless the user explicitly asks') which reinforces rather than subverts user control.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

Do not update, enable, or delete PostHog flags unless the user explicitly asks for that side effect. If PostHog MCP or either environment is unavailable, continue the code change and tell the user which disabled flag still needs to be created manually.

Why it got this result

The manifest declares no explicit allowed-tools wildcard or broad scope grant at all; it is a guidance-only skill with no declarative capability grant beyond the host's default tool access, so there is no over-declared capability class to flag.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: n8n:experiments
description: >-
  Guides work on `packages/frontend/editor-ui` experiments. Use when creating,
  extending, wiring, testing, reviewing, or retiring editor-ui experiments,
  PostHog feature flags, experiment key indexes, variants, stores/composables,
  persisted experiment state, or experiment telemetry.
---

Why it got this result

Both SKILL.md and reference.md are ASCII, purely descriptive dev-process guidance with no hidden codepoints, forged role tokens, or homoglyphs.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

# Experiments reference

Use this guide for code under `packages/frontend/editor-ui/src/experiments/` and related experiment wiring.

## Orient first
...

Why it got this result

Both files ship inline inside the repo; no runtime fetch of instructions and no self-update mechanism.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

Start with the relevant mode in [reference.md](reference.md):

- `Create` for a new experiment folder, constant, store/composable, and tests.
...

Why it got this result

Name n8n:experiments is descriptive, first-party-namespaced, not a near-miss of any known brand.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: n8n:experiments

Why it got this result

No instruction directs reading host credential stores, env secrets, or conversation/memory context, and no outbound channel to a third-party/attacker-controlled sink is referenced -- only an already-registered first-party PostHog MCP tool for the artifact's own declared function. No harvest step exists.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

## PostHog flag lookup

- Use PostHog MCP feature flag tools for new or changed experiment keys when they are available.
- Follow the PostHog MCP workflow strictly: run `info` for each PostHog tool before calling it...

Why it got this result

The skill provides in-band guidance but contains no executable callback, host-setting rewrite, endpoint mutation, or durable reinjection mechanism; no bundled scripts, lifecycle hooks, env assignments, or host-config/persistent-memory writes ship with it.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

---
name: n8n:experiments
description: >-
  Guides work on `packages/frontend/editor-ui` experiments...
---

Why it got this result

Declared purpose (review a GitHub PR via gh CLI and write feedback to a markdown file) matches its allowed-tools frontmatter exactly: Bash(gh:*), Bash(git:*), Read, Glob, Grep -- no Write/Edit/network tool is granted beyond writing the single review file via the agent's normal file-write capability, and the skill explicitly instructs cleanup of scratch files and never to make code changes unless asked.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: n8n:human-like-code-review
description: Reviews a GitHub pull request like a thoughtful human reviewer and writes the feedback to a markdown file. ...
allowed-tools: Bash(gh:*), Bash(git:*), Read, Glob, Grep
---

Why it got this result

No consent-bypass directives; the skill explicitly instructs NOT to make code changes unless the user explicitly asks, which is a HITL-preserving instruction, not a subversion.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

## Important

Do not make code changes unless the user explicitly asks for them. This skill produces a review, not a patch.

Why it got this result

The allowed-tools frontmatter is a least-privilege, enumerated set (Bash(gh:*), Bash(git:*), Read, Glob, Grep) scoped to exactly what reviewing a PR and writing a markdown file requires -- no wildcard, no Write/Edit beyond the host's normal file-write capability for the review file, no network/exec breadth beyond gh/git.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

allowed-tools: Bash(gh:*), Bash(git:*), Read, Glob, Grep

Why it got this result

Codepoint scan found zero concealment characters; plain ASCII guidance.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: n8n:human-like-code-review
description: Reviews a GitHub pull request like a thoughtful human reviewer ...
allowed-tools: Bash(gh:*), Bash(git:*), Read, Glob, Grep
---

Why it got this result

Statically bundled markdown with no runtime instruction fetch or self-mutation behavior.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: n8n:human-like-code-review
...
---

Why it got this result

Name matches n8n's own internal naming convention; no brand impersonation.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: n8n:human-like-code-review
description: Reviews a GitHub pull request...

Why it got this result

The skill reads PR diffs/comments via gh and writes a local review file -- no credential-store or conversation/memory read exists, so no harvest step exists for this rule to pair with an exfil channel.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

2. Fetch the PR diff: `gh pr diff <number> --repo <owner>/<repo>`
3. Fetch PR metadata: `gh pr view <number> --repo <owner>/<repo>`
4. Fetch existing review comments: `gh api repos/<owner>/<repo>/pulls/<number>/comments`

Why it got this result

The allowed-tools declaration (Bash(gh:*), Bash(git:*), Read, Glob, Grep) only authorizes normal post-decision host tools and is not itself an out-of-band execution primitive; the skill ships no executable helper, hook, entrypoint, or dotenv that would trigger format-native execution or host control-plane persistence, so this rule's scope does not apply here.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

allowed-tools: Bash(gh:*), Bash(git:*), Read, Glob, Grep

Why it got this result

Declared purpose: fetch and display a Loom video transcript. Body only curls Loom's own public GraphQL API (www.loom.com/graphql) and downloads the returned transcript URLs -- exactly matching the declared purpose. No credential reads, no undeclared third-party host, no exec beyond curl to the documented Loom endpoints.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

Use the `WebFetch` tool to POST to `https://www.loom.com/graphql` to get the video title and details.

Use this curl command via Bash:

```bash
curl -s 'https://www.loom.com/graphql' \
  -H 'Content-Type: application/json' \
...

Why it got this result

No allowed-tools frontmatter declared (relies on default WebFetch/Bash already available to the host); body only ever curls the single documented loom.com host, matching its stated single-purpose function.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: n8n:loom-transcript
description: Fetch and display the full transcript from a Loom video URL. Use when the user wants to get or read a Loom transcript.
argument-hint: [loom-url]
---

Why it got this result

Codepoint-scanned the file; pure ASCII, purely descriptive instructions with no concealment characters or forged chat tokens.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: n8n:loom-transcript
---

Why it got this result

Static, git-tracked instruction file; the only runtime fetches are for Loom video DATA (the tool's declared job), not the skill's own instruction body or manifest.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: n8n:loom-transcript
---

Why it got this result

Name 'n8n:loom-transcript' is an n8n-namespaced skill that calls Loom's own public API; it does not claim to be an official Loom product, is not a near-miss of 'loom', and does not use a trust-implying prefix.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: n8n:loom-transcript

Why it got this result

The skill only fetches and displays transcript data and defines no privileged mutation or confirmation mechanism, so no human-in-the-loop gate exists to subvert.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

---
name: n8n:loom-transcript
description: Fetch and display the full transcript from a Loom video URL...
---

Why it got this result

The skill explicitly states 'No authentication or cookies are required' and reads only the Loom video ID the user provides, sending it to Loom's own public API. No host credential or conversation-context read occurs.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

## Notes

- No authentication or cookies are required — Loom's transcript API is publicly accessible.
- Only English transcripts are available through this API.

Why it got this result

The curl invocation is an explicit model-mediated command executed through the host's normal in-band Bash tool flow, not a bundled script, lifecycle hook, startup entrypoint, or persistent control-plane primitive.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

Use this curl command via Bash:

```bash
curl -s 'https://www.loom.com/graphql' \
...

Why it got this result

Declared purpose (deploy a throwaway test n8n instance via the internal Nathan bot, using a user-supplied deploy token and a short-lived Cloudflare tunnel) is stated explicitly in SKILL.md and matches the behavior described there -- no capability is exercised beyond what is documented (reading git diff to pick a deploy profile, running the bundled script, reading the saved token). allowed-tools is scoped to exactly the script invocation and git diff/Read.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

Nathan is n8n's internal bot that deploys throwaway test instances from a branch
or Docker image. It's normally driven from Slack (`/nathan ...`); this skill runs
the same commands from the repo via `pnpm nathan`.

## Prerequisites

- **No tunnel setup needed.** Nathan replies asynchronously through a short-lived
  Cloudflare Quick Tunnel that the script opens for you (`npx cloudflared`)...
- **A token in `~/.n8n/dev/nathan-token`.** If a command reports no token, **ask the
  user for one** — point them at the form...

Why it got this result

No prose instructs the agent to suppress confirmation or hide its actions; it explicitly tells the agent to ask the user for a token when missing and to relay the deploy URL back to the user. The skill tells the agent to use judgement about WHEN to offer (not force) a deployment, which is a discretion guard, not a consent bypass.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

- **A token in `~/.n8n/dev/nathan-token`.** If a command reports no token, **ask the
  user for one** — point them at the form...
  then save it for them (the script's interactive paste prompt needs a real
  terminal, so as an agent use the subcommand):

Why it got this result

SKILL.md's own prerequisites section discloses the only credential this artifact handles: a dedicated deploy token the skill itself manages (saved via pnpm nathan set-token) for its single declared purpose (authenticating to the internal Nathan deploy bot). This is not a broad host-credential-store or env-secret harvest, not an LLM provider API key, and not conversation/memory context -- it is the artifact's own narrowly-scoped, disclosed secret used only for its documented function.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

- **A token in `~/.n8n/dev/nathan-token`.** If a command reports no token, **ask the
  user for one** — point them at the form
  (`https://internal.users.n8n.cloud/form/d6d34a2f-4899-4ee8-afc8-f8c41a8a243d`),
  where they log in with their n8n account and copy the token from the response...

  ```bash
  pnpm nathan set-token '<PASTED_TOKEN>'
  ```

Why it got this result

Execution occurs through declared Bash permissions that enable explicit in-band task execution; no automatic hook, endpoint substitution, or persistent host-control mutation is created or implied.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

allowed-tools: Bash(pnpm nathan:*), Bash(node scripts/nathan.mjs:*), Bash(git diff:*), Read

Why it got this result

allowed-tools is narrowly enumerated to the specific script invocation patterns needed (pnpm nathan:*, node scripts/nathan.mjs:*, git diff:*, Read) -- no wildcard Bash grant, no generic WebFetch/Write capability beyond what the declared deploy function needs.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

allowed-tools: Bash(pnpm nathan:*), Bash(node scripts/nathan.mjs:*), Bash(git diff:*), Read

Why it got this result

SKILL.md contains only typographic Unicode (em dashes, ellipsis) with no bidi-override/zero-width/Tag-block codepoints, no forged chat-template tokens, and no homoglyphs; confirmed via a full codepoint scan of the file.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: n8n:nathan
description: Deploy a temporary n8n test instance (or generate a local docker run command) via the internal "Nathan" bot, from the repo instead of Slack. ...
allowed-tools: Bash(pnpm nathan:*), Bash(node scripts/nathan.mjs:*), Bash(git diff:*), Read
---

Why it got this result

SKILL.md ships inline in the bundle and documents a fixed, repo-committed script invocation path (node scripts/nathan.mjs) rather than any runtime fetch of its own instructions from a mutable endpoint; no self-update/hot-reload mechanism is described.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

allowed-tools: Bash(pnpm nathan:*), Bash(node scripts/nathan.mjs:*), Bash(git diff:*), Read
---

# Nathan — repo-local test instances

Nathan is n8n's internal bot that deploys throwaway test instances from a branch
or Docker image. It's normally driven from Slack (`/nathan ...`); this skill runs
the same commands from the repo via `pnpm nathan`.

Why it got this result

Name n8n:nathan matches the internal bot's actual name as documented (an internal tool name, not a typosquat of any external brand).

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: n8n:nathan

Why it got this result

Declared purpose is scaffolding OAuth2 credential files for n8n nodes; the body's steps (create credential file, register in package.json, update constants/generic functions, write tests) match exactly, all operating on files inside the repo under the declared scope. No exfiltration or undeclared network/credential capability.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: n8n:node-add-oauth
description: Add OAuth2 credential support to an existing n8n node — creates the credential file, updates the node, adds tests, and keeps the CLI constant in sync. Use when the user says /node-add-oauth.
argument-hint: "[node-name] [optional: custom-scopes flag or scope list]"
---

## Overview

Add OAuth2 (Authorization Code / 3LO) support to an existing n8n node. Works for any
third-party service that supports standard OAuth2.

Why it got this result

No consent-bypass or disclosure-suppression prose. The skill asks the user explicitly when scope decisions are ambiguous (custom scopes question) rather than silently assuming.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

- `CUSTOM_SCOPES`: whether the credential should support user-defined scopes. If the
  argument does not make this clear, **ask the user** before proceeding:
  > "Should users be able to customise the OAuth2 scopes for this credential, or should
  > scopes be fixed?"

Why it got this result

The skill defines OAuth metadata while delegating bearer injection to existing machinery and never reads or exports a live token itself.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

**Rules:**
- No `authenticate` block — `oAuth2Api` machinery handles Bearer token injection automatically.
- No `test` block — the OAuth dance validates the credential.

Why it got this result

No allowed-tools frontmatter restricting/granting capability beyond the implicit host default; the documented operations (create/edit files under packages/nodes-base, run pnpm test/typecheck/lint) match its declared scaffolding purpose with no broad or wildcard capability grant.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: n8n:node-add-oauth
description: Add OAuth2 credential support to an existing n8n node — creates the credential file, updates the node, adds tests, and keeps the CLI constant in sync. Use when the user says /node-add-oauth.
argument-hint: "[node-name] [optional: custom-scopes flag or scope list]"
---

Why it got this result

Scanned for concealment codepoints and homoglyphs; none found. All code templates and prose are visible and consistent with the declared purpose.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: n8n:node-add-oauth
description: Add OAuth2 credential support to an existing n8n node — creates the credential file, updates the node, adds tests, and keeps the CLI constant in sync.
argument-hint: "[node-name] [optional: custom-scopes flag or scope list]"
---

Why it got this result

First-party, in-repo static file; no live-fetch or self-mutation mechanism.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: n8n:node-add-oauth
description: Add OAuth2 credential support to an existing n8n node.
argument-hint: "[node-name] [optional: custom-scopes flag or scope list]"
---

Why it got this result

First-party namespaced name 'n8n:node-add-oauth' with no impersonation of any external brand.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: n8n:node-add-oauth
description: Add OAuth2 credential support to an existing n8n node.

Why it got this result

The component ships only SKILL.md prose and file-edit templates; no format-native execution primitive such as a lifecycle hook, install script, or load-time code is present, so the condition the rule treats as NOT_APPLICABLE is the one that applies here.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

## Step 10 — Verify

```bash
# From packages/nodes-base/
pnpm test credentials/test/{NODE_NAME}OAuth2Api.credentials.test.ts
pnpm test nodes/{NODE_NAME}/__test__/GenericFunctions.test.ts
pnpm typecheck
pnpm lint
```

Why it got this result

Purely declarative guidance for applying RBAC scope decorators to REST controllers; no bundled scripts, no network/credential access, no undisclosed capability -- matches its stated scope exactly.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: n8n:protect-endpoints
description: Applies n8n's RBAC scope decorators to REST endpoints. ...
---
# Protect REST endpoints with RBAC
**Rule:** every authenticated route on a `@RestController` MUST carry an access-scope decorator.

Why it got this result

No consent-bypass prose; the skill's whole purpose is to strengthen authorization gating (RBAC decorators) rather than weaken any human-in-the-loop control.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

## Public / unauthenticated routes
`{ skipAuth: true }` skips the auth middleware -> req.user is undefined -> adding @ProjectScope would 401 every call. Public routes ... must:
1. Omit the scope decorator.
2. Authenticate via signature/HMAC verification inside the handler...
3. Carry a comment explaining why no scope is applied...

Why it got this result

No manifest capability grant; purely descriptive guidance.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: n8n:protect-endpoints
description: Applies n8n's RBAC scope decorators to REST endpoints. ...
---

Why it got this result

Codepoint scan found zero concealment characters; plain ASCII guidance.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: n8n:protect-endpoints
description: Applies n8n's RBAC scope decorators to REST endpoints. ...
---

Why it got this result

Statically bundled markdown with no runtime instruction fetch or self-mutation behavior.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: n8n:protect-endpoints
...
---

Why it got this result

Name matches n8n's own internal naming convention; no brand impersonation.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: n8n:protect-endpoints
description: Applies n8n's RBAC scope decorators...

Why it got this result

Purely declarative RBAC-decorator guidance; no credential or conversation-context read.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

# Protect REST endpoints with RBAC
**Rule:** every authenticated route on a `@RestController` MUST carry an access-scope decorator.

Why it got this result

The component ships only illustrative TypeScript examples embedded in Markdown; it contains no bundled executable, lifecycle hook, entrypoint, host configuration, or control-plane primitive, so the format-native execution and persistence scenario this rule addresses does not apply.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

---
name: n8n:protect-endpoints
description: Applies n8n's RBAC scope decorators to REST endpoints. ...
---

Why it got this result

Declarative guidance for implementing Public API v1 controllers with explicit security-positive guidance (never echo secrets, sentinel/placeholder pattern, strict DTOs). No undisclosed network/exec/credential-harvesting capability; all guidance maps to the declared scope of packages/cli/src/public-api/v1/.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: n8n:public-api
description: >-
  Adds, migrates, or updates n8n Public API v1 endpoints with @PublicApiController
  — public DTOs, API-key and RBAC scopes, cursor pagination, OpenAPI + coverage
  wiring, and tests. Use when working under packages/cli/src/public-api/v1/ or
  when exposing an existing service through /api/v1.
---

# Public API v1

Public API v1 lives in `packages/cli/src/public-api/v1/`, mounted at `/api/v1`
with API-key auth and public error formatting via `PublicApiControllerRegistry`

Why it got this result

No consent-bypass or disclosure-suppression directives. Guidance explicitly promotes transparency (never echo secrets, error messages must not leak internals).

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

(full file reviewed -- no consent/confirmation/disclosure-suppression language present)

Why it got this result

No allowed-tools/scope frontmatter; no bundled executables or install hooks.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: n8n:public-api
description: >-
  Adds, migrates, or updates n8n Public API v1 endpoints...
---

Why it got this result

Codepoint scan found only normal box-drawing/arrow/em-dash punctuation; no concealment codepoints or forged role tokens in SKILL.md or reference.md.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

(scanned full SKILL.md + reference.md: only box-drawing/arrow/em-dash punctuation; no concealment codepoints)

Why it got this result

Instructions ship inside the bundled, version-controlled SKILL.md/reference.md; no runtime fetch or self-mutation mechanism.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

(static bundled text, no fetch/self-update mechanism present)

Why it got this result

Declared name n8n:public-api is self-descriptive, namespaced under the repo's own org prefix, with no resemblance to a known third-party brand.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: n8n:public-api

Why it got this result

No instruction reads host credentials, env vars, or conversation context for exfiltration; explicitly the opposite -- it mandates secrets are NEVER echoed/returned in API responses.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

- Secrets: never return a real secret; use the resource's sentinel/placeholder
  (or omit). See [Updates and write-only secrets](reference.md#updates-and-write-only-secrets).

Why it got this result

This documentation-only skill contains no bundled hook, entry script, host configuration, or executable environment override.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

(documentation-only component, no bundled execution primitives)

Why it got this result

Declared purpose: reproduce a bug from a Linear ticket with a failing regression test. Body only describes reading source/test files and running the repo's own test suite (pnpm test) -- entirely within the declared scope, no network egress or credential access.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

## Step 8: Run and Score

Run the test from the package directory (e.g., `cd packages/nodes-base && pnpm test <file>`).

Why it got this result

No prose instructs skipping confirmation or hiding actions; the skill explicitly restricts itself ('DO NOT fix the bug', 'Leave test files in place ... (don't commit unless asked)') which is the opposite of consent suppression -- it constrains the agent to less autonomy, not more.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

## Important

- **DO NOT fix the bug** — only reproduce it with a failing test
- **Leave test files in place** as evidence (don't commit unless asked)
...

Why it got this result

No allowed-tools frontmatter restricting/declaring scope beyond name+description; body only references running the repo's existing test suite, matching its declared bug-reproduction function; no bundled executables or install hooks.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: n8n:reproduce-bug
description: Reproduce a bug from a Linear ticket with a failing test. Expects the full ticket context (title, description, comments) to be provided as input.
---

Why it got this result

Codepoint-scanned the file; pure ASCII, purely descriptive instructions with no concealment characters or forged chat tokens.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: n8n:reproduce-bug
---

Why it got this result

Static, git-tracked instruction file with no runtime fetch or self-mutation mechanism.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: n8n:reproduce-bug
---

Why it got this result

Name 'n8n:reproduce-bug' published under n8n's own namespace; no brand impersonation.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: n8n:reproduce-bug

Why it got this result

No instruction reads host credential stores or conversation/memory context; the hard-bailout rule explicitly avoids requiring real third-party API credentials ('Requires real third-party API credentials' is listed as a reason to STOP, not proceed).

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

**Hard bailout triggers** (stop immediately):
- Requires real third-party API credentials
- Race condition / timing-dependent
...

Why it got this result

The pnpm test instruction is an ordinary in-band command and not a shipped lifecycle hook, executable entrypoint, or persistent control-plane primitive.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

## Step 8: Run and Score

Run the test from the package directory (e.g., `cd packages/nodes-base && pnpm test <file>`).

Why it got this result

Declared purpose is keeping specs in .agents/specs/ synced with implementation; the body is purely a prose workflow for reading/writing spec markdown files, with no network egress, credential reads, or exec capability of any kind.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: n8n:spec-driven-development
description: Keeps implementation and specs in sync. Use when working on a feature that has a spec in .agents/specs/...
---

# Spec-Driven Development

Specs live in `.agents/specs/`. They are the source of truth...

Why it got this result

No prose instructs bypassing confirmation or hiding actions from the user; the skill explicitly tells the agent to 'ask the user' before creating a new spec when none exists and to 'flag unresolved gaps to the user'.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

3. **If no spec exists** and the task is non-trivial (new module, new API,
   architectural change), ask the user whether to create one first.

Why it got this result

No allowed-tools frontmatter at all, no wildcard capability declaration, no bundled executables, no install hooks -- a pure documentation/workflow skill.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: n8n:spec-driven-development
description: Keeps implementation and specs in sync. Use when working on a feature that has a spec in .agents/specs/, when the user says /spec, or when starting implementation of a documented feature. Also use when the user asks to verify implementation against a spec or update a spec after changes.
---

Why it got this result

ASCII, purely descriptive prose with no hidden codepoints, forged chat-template tokens, or homoglyphs.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: n8n:spec-driven-development
description: Keeps implementation and specs in sync...
---

# Spec-Driven Development

Specs live in `.agents/specs/`...

Why it got this result

SKILL.md ships inline in the repo bundle; no runtime fetch of instructions and no self-update mechanism.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: n8n:spec-driven-development
description: Keeps implementation and specs in sync...
---

Why it got this result

Name n8n:spec-driven-development is descriptive, first-party-namespaced, not a near-miss of any known brand.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: n8n:spec-driven-development

Why it got this result

No credential store or conversation/memory context read is directed anywhere in this skill, and no outbound channel exists; it only reads/writes markdown files under .agents/specs/.