n8n-io/n8n hook server skill
workflow automation
n8n is a workflow automation platform designed for building and deploying AI agents and multi-step automations. It provides a visual canvas editor where you can combine drag-and-drop configuration with custom code (JavaScript, Python), connect to 1500+ integrations, and run workflows either self-hosted or in the cloud.
Build AI workflows that chain together multiple steps, tool calls, and human approvals with a visual editor Connect to OpenAI, Anthropic, Google, or open-source LLMs without vendor lock-in Prototype and deploy automation workflows from development through production with full observability Integrate AI agents with existing systems using 1500+ pre-built connectors or custom code Self-host your workflows for data privacy and control, or use the managed cloud version 4 CRITICAL✓ 22 HIGH✓ 1744 MEDIUM 29 LOW 2 INFO
✓ CRITICAL/HIGH reflect AI-verified findings (false positives excluded) · MEDIUM/LOW/INFO are unverified scanner output
AI-verified (CRITICAL/HIGH): 26 likely real (100%) 90 false positive — excluded from CRITICAL/HIGH count above
Findings by checker · 6 high-signal, 11 mostly false-positive (hidden by default)
CHK-081 4 findings 4 likely
0% FP CHK-105 3 findings 2 likely 1 false positive
33% FP CHK-101 3 findings 2 likely 1 false positive
33% FP CHK-128 2 findings 2 likely
0% FP CHK-090 1 finding 1 likely
0% FP CHK-083 1 finding 1 likely
0% FP ▼ Show 11 checkers that are mostly false positives (102 findings) 110 findings click to expand
CHK-081 Command injection risk — exec/execSync with string interpolation in .github/actions/ci-filter/ci-filter.mjs
.github/actions/ci-filter/ci-filter.mjs
AI: likely real confirmed ▼
CHK-081 Command injection risk — exec/execSync with string interpolation in packages/nodes-base/nodes/ExecuteCommand/ExecuteCommand.node.ts
packages/nodes-base/nodes/ExecuteCommand/ExecuteCommand.node.ts
AI: likely real confirmed ▼
CHK-081 Command injection risk — exec/execSync with string interpolation in packages/@n8n/node-cli/src/commands/dev/utils.ts
packages/@n8n/node-cli/src/commands/dev/utils.ts
AI: likely real confirmed ▼
CHK-081 Command injection risk — exec/execSync with string interpolation in packages/nodes-base/nodes/Merge/v3/helpers/sandbox-utils.ts
packages/nodes-base/nodes/Merge/v3/helpers/sandbox-utils.ts
AI: likely real confirmed ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in typescript-migration/benchmark.mjs
scripts/typescript-migration/benchmark.mjs
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — Token: str
packages/cli/src/interfaces.ts
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — password: str
packages/workflow/src/interfaces.ts
AI: likely real likely ▼
CHK-090 HTTP transport bound to 0.0.0.0 — exposed to all network interfaces
packages/testing/containers/dockerfiles/kent/kent_cors.py
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — "credentials"
packages/nodes-base/nodes/Okta/__schema__/v1.0.0/user/get.json
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — token: str
packages/nodes-base/nodes/Rundeck/RundeckApi.ts
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — token: str
packages/cli/src/services/ai-gateway.service.ts
AI: likely real likely ▼
CHK-128 ToxicFlow chain: read_file → send_email
AI: likely real likely ▼
CHK-105 Secret echoed to CI logs in .github/workflows/docker-build-push.yml
.github/workflows/docker-build-push.yml
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — "credentials"
packages/nodes-base/nodes/Okta/__schema__/v1.0.0/user/getAll.json
AI: likely real likely ▼
CHK-083 Potential path traversal — user-controlled path in file operation: packages/@n8n/instance-ai/evaluations/computer-use/daemon.ts
packages/@n8n/instance-ai/evaluations/computer-use/daemon.ts
AI: likely real possible ▼
CHK-129 Sensitive field in return type/schema — token: str
packages/cli/src/modules/instance-ai/filesystem/local-gateway-registry.ts
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — secret: str
packages/cli/src/modules/mcp/mcp.typeguards.ts
AI: likely real likely ▼
CHK-101 Admin/privileged operation without role check
packages/@n8n/computer-use/src/confirm-resource-cli.ts
AI: likely real likely ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in ci-filter/ci-filter.mjs
.github/actions/ci-filter/ci-filter.mjs
AI: likely real likely ▼
CHK-101 Admin/privileged operation without role check
packages/@n8n/agents/src/workspace/tools/delete-file.ts
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — password: str
packages/cli/src/public-api/types.ts
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — Token: str
packages/cli/src/modules/agents/integrations/slack-app-setup.service.ts
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — Token: str
packages/cli/src/modules/instance-ai/mcp/instance-ai-mcp-registry.service.ts
AI: likely real likely ▼
CHK-128 ToxicFlow chain: read_file → http_request
AI: likely real likely ▼
CHK-105 Secret echoed to CI logs in .github/actions/setup-nodejs/action.yml
.github/actions/setup-nodejs/action.yml
AI: likely real likely ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in scripts/bump-versions.mjs
.github/scripts/bump-versions.mjs
AI: likely real likely ▼
CHK-054 Tool 'Get' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Freshdesk/Freshdesk.node.ts
possible ▼
CHK-054 Tool 'Get' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Wekan/CardDescription.ts
possible ▼
CHK-054 Tool 'Delete' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Freshdesk/Freshdesk.node.ts
possible ▼
CHK-054 Tool 'Delete' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Wekan/CardDescription.ts
possible ▼
CHK-054 Tool 'Update' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Wekan/ChecklistItemDescription.ts
possible ▼
CHK-054 Tool 'search' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/NextCloud/NextCloud.node.ts
possible ▼
CHK-054 Tool 'Get' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Wekan/ChecklistItemDescription.ts
possible ▼
CHK-054 Tool 'Update' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Wekan/CardDescription.ts
possible ▼
CHK-054 Tool 'Get' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Bannerbear/TemplateDescription.ts
possible ▼
CHK-054 Tool 'Get' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Bannerbear/ImageDescription.ts
possible ▼
CHK-054 Tool 'Delete' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Wekan/ChecklistItemDescription.ts
possible ▼
CHK-054 Tool 'Search' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/NextCloud/NextCloud.node.ts
possible ▼
CHK-081 Command injection risk — exec/execSync with string interpolation in .github/scripts/bump-versions.mjs [build-script context]
.github/scripts/bump-versions.mjs
possible ▼
CHK-042 Supabase Service Role Key detected in packages/testing/playwright/workflows/Pinned_webhook_node.json [test context]
packages/testing/playwright/workflows/Pinned_webhook_node.json
possible ▼
CHK-054 Tool 'Get' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Wekan/BoardDescription.ts
possible ▼
CHK-054 Tool 'Delete' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Wekan/BoardDescription.ts
possible ▼
CHK-054 Tool 'Read' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/NextCloud/NextCloud.node.ts
possible ▼
CHK-054 Tool 'Get' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Wekan/CardCommentDescription.ts
possible ▼
CHK-054 Tool 'Delete' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Wekan/CardCommentDescription.ts
possible ▼
CHK-054 Tool 'Update' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/NextCloud/NextCloud.node.ts
possible ▼
CHK-054 Tool 'Get' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Wekan/ListDescription.ts
possible ▼
CHK-054 Tool 'Delete' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Wekan/ListDescription.ts
possible ▼
CHK-054 Tool 'Get' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/NextCloud/NextCloud.node.ts
possible ▼
CHK-054 Tool 'Get' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Wekan/ChecklistDescription.ts
possible ▼
CHK-054 Tool 'Delete' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Wekan/ChecklistDescription.ts
possible ▼
CHK-054 Tool 'Delete' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/NextCloud/NextCloud.node.ts
possible ▼
CHK-081 Command injection risk — exec/execSync with string interpolation in .github/scripts/verify-safechain.mjs [build-script context]
.github/scripts/verify-safechain.mjs
possible ▼
CHK-042 Supabase Service Role Key detected in packages/cli/src/auth/__tests__/auth.service.test.ts [test context]
packages/cli/src/auth/__tests__/auth.service.test.ts
possible ▼
CHK-054 Tool 'Get' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Magento/OrderDescription.ts
possible ▼
CHK-054 Tool 'Update' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Magento/ProductDescription.ts
possible ▼
CHK-054 Tool 'POST' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Webhook/description.ts
possible ▼
CHK-054 Tool 'Get' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Magento/ProductDescription.ts
possible ▼
CHK-054 Tool 'Delete' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Magento/ProductDescription.ts
possible ▼
CHK-054 Tool 'GET' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Webhook/description.ts
possible ▼
CHK-081 Command injection risk — exec/execSync with string interpolation in .github/scripts/retry.mjs [build-script context]
.github/scripts/retry.mjs
possible ▼
CHK-054 Tool 'Update' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Magento/CustomerDescription.ts
possible ▼
CHK-054 Tool 'Get' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Magento/CustomerDescription.ts
possible ▼
CHK-054 Tool 'DELETE' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Webhook/description.ts
possible ▼
CHK-054 Tool 'Delete' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Magento/CustomerDescription.ts
possible ▼
CHK-054 Tool 'Update' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/TheHive/TheHive.node.ts
possible ▼
CHK-054 Tool 'POST' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Webhook/Webhook.node.ts
possible ▼
CHK-073 Curl Pipe Bash Install detected in packages/@n8n/computer-use/src/tools/shell/build-shell-resource.test.ts [test context]
packages/@n8n/computer-use/src/tools/shell/build-shell-resource.test.ts
possible ▼
CHK-054 Tool 'Search' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/TheHive/TheHive.node.ts
possible ▼
CHK-054 Tool 'Get' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/TheHive/TheHive.node.ts
possible ▼
CHK-054 Tool 'GET' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Webhook/Webhook.node.ts
possible ▼
CHK-054 Tool 'Delete' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Vero/UserDescription.ts
possible ▼
CHK-054 Tool 'Delete' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Mautic/CompanyDescription.ts
possible ▼
CHK-054 Tool 'search' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/WooCommerce/OrderDescription.ts
possible ▼
CHK-054 Tool 'DELETE' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Webhook/Webhook.node.ts
possible ▼
CHK-054 Tool 'Search' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/WooCommerce/OrderDescription.ts
possible ▼
CHK-054 Tool 'Get' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Mautic/ContactDescription.ts
possible ▼
CHK-054 Tool 'Update' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/WooCommerce/OrderDescription.ts
possible ▼
CHK-054 Tool 'Get' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/WooCommerce/OrderDescription.ts
possible ▼
CHK-054 Tool 'Get' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/SendGrid/ContactDescription.ts
possible ▼
CHK-054 Tool 'Delete' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/WooCommerce/OrderDescription.ts
possible ▼
CHK-054 Tool 'search' — generic name without namespace prefix (shadow risk)
packages/cli/src/modules/instance-ai/mcp/__tests__/instance-ai-mcp-registry.service.test.ts
possible ▼
CHK-044 Slack Bot Token detected in packages/@n8n/mcp-browser/src/adapters/playwright.get-element-value.test.ts [test context]
packages/@n8n/mcp-browser/src/adapters/playwright.get-element-value.test.ts
possible ▼
CHK-042 Supabase Service Role Key detected in packages/testing/playwright/workflows/Check_manual_node_run_for_pinned_and_rundata.json [test context]
packages/testing/playwright/workflows/Check_manual_node_run_for_pinned_and_rundata.json
possible ▼
CHK-054 Tool 'Get' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Affinity/PersonDescription.ts
possible ▼
CHK-054 Tool 'search' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/WooCommerce/ProductDescription.ts
possible ▼
CHK-054 Tool 'Edit' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/WooCommerce/ProductDescription.ts
possible ▼
CHK-054 Tool 'get' — generic name without namespace prefix (shadow risk)
packages/cli/src/modules/mcp/__tests__/validate-workflow-code.tool.test.ts
possible ▼
CHK-054 Tool 'Search' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/WooCommerce/ProductDescription.ts
possible ▼
CHK-054 Tool 'Delete' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/QuickBase/FileDescription.ts
possible ▼
CHK-054 Tool 'Run' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/QuickBase/ReportDescription.ts
possible ▼
CHK-054 Tool 'Update' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/WooCommerce/ProductDescription.ts
possible ▼
CHK-054 Tool 'search' — generic name without namespace prefix (shadow risk)
packages/cli/src/modules/mcp/__tests__/validate-workflow-code.tool.test.ts
possible ▼
CHK-054 Tool 'Get' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/QuickBase/ReportDescription.ts
possible ▼
CHK-054 Tool 'Delete' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Redis/Redis.node.ts
possible ▼
CHK-054 Tool 'Get' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/Redis/Redis.node.ts
possible ▼
CHK-054 Tool 'Delete' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/SendGrid/ListDescription.ts
possible ▼
CHK-054 Tool 'Get' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/SendGrid/ListDescription.ts
possible ▼
CHK-054 Tool 'Update' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/SendGrid/ListDescription.ts
possible ▼
CHK-054 Tool 'Delete' — generic name without namespace prefix (shadow risk)
packages/nodes-base/nodes/SendGrid/ContactDescription.ts
possible ▼
▼ Show 90 false positives (45% of this view) Last scanned: Jul 12, 2026
More servers
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
skypilot-org/skypilot 85
obra/superpowers 85
Foundational skill pack by Jesse Vincent now in anthropics/claude-plugins-official. Includes ffuf web-fuzzing/pentest skill. Partial analysis done — full hook and plugin inspection pending. tier=T2
191k★
Significant-Gravitas/AutoGPT 85
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.
186k★
nanocoai/nanoclaw 85
A lightweight alternative to OpenClaw that runs in containers for security. Connects to WhatsApp, Telegram, Slack, Discord, Gmail and other messaging apps,, has memory, scheduled jobs, and runs directly on Anthropic's Agents SDK
30k★
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
Scan your entire org's MCP deployment
2,500+ repos pre-scored. 22% carry CRITICAL findings.