n8n Workflow Audit

    1

    Audit n8n workflows for security leaks, missing error handling, and production failure risks using n8n-audit.

    $29

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned

    Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+21 more

    n8n Workflow Audit

    Example session with this skill installed

    Run a pre-production audit on lead-gen-flow.json and tell me if it is safe to deploy.

    • Read your context and instructions
    • Compiled the n8n workflow audit

    I have performed a static audit on lead-gen-flow.json using the n8n-audit linter. The scan identified 3 findings that should be addressed before deployment.

    n8n Audit Report: lead-gen-flow.json

    SeverityNode NameFindingRemediation
    HighSlack Webhooksecrets-in-parametersMove the Slack URL token to an n8n Credential or environment variable.
    HighWorkflow Settingsmissing-error-workflowAssign an Error Workflow in Settings to handle execution failures.
    MediumHTTP Requesthttp-without-retryEnable 'Retry on Fail' in the node settings (3 tries recommended).
    LowHTTP Requestdefault-node-namesRename node to describe its function (e.g., "Post to CRM").

    Summary: 2 High, 1 Medium, 1 Low findings.
    Exit Code: 1 (Failed)

    The audit indicates this workflow is

    not ready for production. The presence of a hardcoded Slack token is a security risk, and the lack of an error workflow means failures will be silent.

    Next steps

    1. Move the Slack token into a new n8n Secret and rotate the current token.
    2. Create or link a standard error handling workflow in the workflow settings.
    3. Enable retry logic on the HTTP Request node to handle transient network issues.
    lead-gen-flow.json

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Your workflow runs green in the editor. That is exactly the problem.

    n8n workflows get promoted from tutorial state to production carrying problems nobody checked for: a secret pasted into a node, a webhook anyone can call, no error workflow so failures stay silent, no deduplication so a redelivered webhook emails a lead twice. n8n Workflow Audit is the operating skill for n8n-audit, the open-source linter that checks exported workflow JSON for exactly those failure classes, and it teaches your agent to run the audit the way a production reviewer would.

    What your agent learns to do:

    • Run the linter on any exported workflow JSON, a single file or a whole folder of exports, locally or in CI, with no n8n instance and no network.
    • Check all 8 production failure classes: pasted secrets, credentials stored outside the n8n credential store, unauthenticated webhooks, missing error workflows, missing deduplication, HTTP nodes without retry, default node names, and missing documentation.
    • Read the report properly: findings grouped by severity, highs as launch blockers, mediums as fix-or-accept, lows as scheduled debt, with exit codes 0, 1, and 2 explained and used as the CI contract.
    • Apply the one-line remediation that comes with every finding, then re-export and re-audit, so a fix is only reported once a fresh run proves it.
    • Run a full pre-production audit for a client or team: collect the exports, audit with JSON output as the evidence base, hand over before and after counts with an honestly scoped claim.

    Safety is the point. The tool only reads: it never runs, schedules, or modifies a workflow, never connects to an n8n instance, and never calls the network. The skill keeps that stance: fixes are applied in n8n by the workflow owner, secrets findings are referred to by node and parameter and rotated, never repeated.

    Five workflows included: a fixture walkthrough with known results that proves the setup, a pre-production check on one workflow, a whole-library audit, a CI gate recipe, and the client hand-over audit. The full 8-rule reference and real example reports in text and JSON form are in the reference files.

    Requirements: the n8n-audit tool, free and MIT licensed at github.com/techaurah/n8n-audit (this skill is the operating playbook for it). Python 3.10 or newer, zero runtime dependencies, works fully offline. You bring exported workflow JSON from n8n; nothing else is needed.

    Deduplication detection relies on keyword heuristics. Scans exported JSON only; does not validate runtime logic, performance, or external service availability.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before any payment.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed today

    Software
    Python

    Permissions

    Terminal / Shell
    Network Access
    Listedtoday

    What's inside

    Frequently Asked Questions

    This skill scans exported n8n workflow JSON files to detect hidden security risks like hardcoded credentials, unauthenticated webhooks, and reliability issues like missing error-handling logic. It prevents production failures by catching these mistakes before they are deployed.

    The skill is a standalone audit tool that requires Python 3.10 or newer and works with standard n8n JSON exports. It is designed to be integrated into any AI agent workflow or CI/CD pipeline that handles automation file management.

    Yes, because it performs static analysis on a local JSON file, it can be used to audit hundreds of workflows simultaneously. This makes it ideal for cleaning up legacy automation libraries or performing bulk security audits for clients.

    No, this skill performs static analysis on your exported JSON files and does not require access to your live n8n instance or credentials. This ensures your production environment remains secure and untouched during the auditing process.

    Each finding comes with specific remediation guidance, providing clear instructions or one-line fixes to resolve the issue. Once you apply the changes in n8n, you can re-export and re-scan the file to verify the fix.

    Generic LLMs often miss nested parameters or hallucinate node configurations; this skill uses a deterministic linter to ensure every security risk is captured. It provides a consistent, repeatable audit trail that is far more reliable for professional hand-overs and production gates.

    New in Workflow Automation