N8n Security Testing

Scans your n8n workflows for exposed credentials, tests OAuth token handling, and validates webhook authentication. You get pattern matching for API keys, JWT tokens, AWS credentials, and other secrets that shouldn't be in workflow JSON or logs. Also checks encryption at rest and tests credential rotation for OAuth flows. The quick reference card breaks down risk levels by area, which is actually helpful when you're triaging. Most useful during security reviews or before moving workflows to production. The pattern library is solid but you'll want to extend it for your specific services.

skills.sh installs: 172
GitHub stars: 524
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add proffesor-for-testing/agentic-qe --skill n8n-security-testing --agent claude-code

Installs into .claude/skills of the current project.

Files

n8n Security Testing

<default_to_action> When testing n8n security:

SCAN for credential exposure in workflows
VERIFY encryption of sensitive data
TEST OAuth token handling
CHECK for insecure data transmission
VALIDATE input sanitization

Quick Security Checklist:

No credentials in workflow JSON
No credentials in execution logs
OAuth tokens properly encrypted
API keys not in version control
Webhook authentication enabled
Input data sanitized

Critical Success Factors:

Scan all workflow exports
Test credential rotation
Verify encryption at rest
Check audit logging </default_to_action>

Quick Reference Card

Security Risk Areas

Area	Risk Level	Testing Focus
Credential Storage	Critical	Encryption, exposure
Webhook Security	High	Authentication, validation
Expression Injection	High	Input sanitization
Data Leakage	Medium	Logging, error messages
OAuth Flows	Medium	Token handling, refresh