Trust Report

n8n Automation — Build & Deliver Workflows Fast

Build, customize, and deliver n8n workflows using our 2,061-template library. Reference: `~/projects/n8n-workflows/` — browse by integration folder. Our n8n instance: `localhost:5678` (requires `fnm use 22` before starting). All outputs go to `workspace/artifacts/`.

SUSPICIOUS

Format: genericScanner: v0.8.0Duration: 10msScanned: 8d ago · May 30, 7:38 AMSource →

Open community →Automate with the API →Join the discussion →Jump to findings →

Embed this badge

[![AgentVerus](https://agentverus.ai/api/v1/skill/0bb80509-40d1-46a3-9437-adb4d5e97d6b/badge)](https://agentverus.ai/skill/0bb80509-40d1-46a3-9437-adb4d5e97d6b)

Community Discussion

Community Comments

Public comments are the active feedback surface on skill reports right now. Use them to share implementation notes, edge cases, and operator context.

0 comments

No comments yet. Be the first to share your thoughts.

Continue the workflow

Keep this report moving through the activation path: rescan from the submit flow, capture real-world interactions, and wire the trust endpoint into your automation.

Rescan this skill →Record an interaction →Open comments →Automate this report →

https://agentverus.ai/api/v1/skill/0bb80509-40d1-46a3-9437-adb4d5e97d6b/trust

Personalized next commands

Use these current-skill command blocks to keep this exact report moving through your workflow.

Record an interaction

curl -X POST https://agentverus.ai/api/v1/interactions \
  -H "Authorization: Bearer at_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"agentPlatform":"openclaw","skillId":"0bb80509-40d1-46a3-9437-adb4d5e97d6b","interactedAt":"2026-03-15T12:00:00Z","outcome":"success"}'

Fetch trust JSON

curl https://agentverus.ai/api/v1/skill/0bb80509-40d1-46a3-9437-adb4d5e97d6b/trust

Category Scores

Permissions

Injection

Dependencies

Behavioral

Content

100

Code Safety

Findings (11)

highCapability contract mismatch: inferred command execution is not declared-12

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: Execute

→ Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03

highComprehensive secret collection detected-25

Found comprehensive secret collection pattern: "All credentials"

- [ ] All credentials use THEIR API keys (never ours)

→ Skills should not instruct collection of all tokens, keys, or credentials. Access only the specific credentials needed and declare them.

injectionASST-05

highCredential access detected-25

Found credential access pattern: "credentials store"

- [ ] Sensitive data isn't hardcoded in nodes (use credentials store)

→ Remove references to credentials and secrets. Skills should never access sensitive authentication data.

injectionASST-05

highLocal service access detected-15

Found local service access pattern: "http://localhost:5678"

**Access:** http://localhost:5678

→ Treat localhost and loopback services as privileged local attack surfaces. Require explicit approval, constrain reachable ports, and avoid combining local access with session reuse or tunneling.

behavioralASST-03

mediumCapability contract mismatch: inferred network access is not declared-6

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: http://localhost:5678

→ Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-04

mediumCapability contract mismatch: inferred content extraction is not declared-8

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: Screenshot

→ Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-02

mediumCapability contract mismatch: inferred local service access is not declared-8

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: http://localhost:5678

→ Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03

mediumHigh-risk workflow lacks explicit safety boundaries-15

The skill performs or enables higher-risk operations but does not define explicit safety boundaries describing what it must not do.

No safety boundary patterns found alongside high-risk capability language

→ Add a 'Safety Boundaries' section listing what the skill must NOT do (e.g., no file deletion, no network access beyond needed APIs).

contentASST-09

mediumFederated auth flow detected-10

Found federated auth flow pattern: "OAuth"

- What **credentials** are required? (API keys, OAuth, etc.)

→ Treat OAuth, 2FA, and token-refresh guidance as authentication-sensitive workflows. Explain scope, storage, and refresh behavior clearly so agents do not handle more credential material than necessary.

behavioralASST-05

mediumLocal service URL reference-8

The skill references a localhost or private-network service URL which is classified as medium risk. Merged overlapping signals from the repeated finding family: - Local service URL reference

http://localhost:5678

→ Review localhost/private-network service references carefully. Local service URLs can expose internal apps, admin panels, or developer tooling to agent-driven workflows.

dependenciesASST-04

infoError handling instructions present

The skill includes error handling instructions for graceful failure.

Error handling patterns detected

→ Keep these error handling instructions.

contentASST-09