{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "n8n-workflow-skills",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Executes local scripts or commands: The host calls repository scripts via hooks.json: SessionStart→hooks/session-start.sh (`\"command\": \"${C"
    },
    {
      "file": "网络端点",
      "summary": "Declares external network access: Zero network calls in hook scripts: no curl/wget/nc/dev-tcp/eval calls throughout hooks/; only reads stdin, writes /tmp markers, and outputs"
    },
    {
      "file": "本地工作目录",
      "summary": "File read/write and artifact output: Deduplication marker files: `MARKER=\"${STATE_DIR}/${SESSION_ID}-${MARKER_NAME}.loaded\"` + `touch"
    }
  ],
  "verification": {
    "method": "第一遍：只读通读仓库（15 个 SKILL.md 的 frontmatter 与结构、hooks/ 全部 9 个脚本逐行、hooks.json、build.sh、mcp.json / .mcp.json.example / 三个 manifest、docs/、README、CLAUDE.md、NOTICES、evaluations 抽样），按 file+line+逐字 quote 取证。第二遍独立复核（换角度找茬）：①对 hooks 目录做『找反例』式扫描（curl/wget/nc/dev-tcp/eval/base64/N8N_API/API_KEY/TOKEN/.env/keychain/.claude）确认无遗漏的网络与凭证路径；②重读 _emit.sh 与 session-start.sh 全部行，确认写路径与读取的 env 集合；③重读 hooks.json 的 matcher 与 command 全部条目核对 exec 链；④对照 README/CLAUDE.md 宣称（npm test、claude-code --skill、npm 包名）与仓库实际文件，找出无法兑现者；⑤复核 glob **/SKILL.md 得 15 个并区分 14 个 n8n-* 与 1 个 router；⑥核对 pin。",
    "second_pass": [
      {
        "item": "skill.path = skills/using-n8n-mcp-skills",
        "status": "ok",
        "detail": "重读 skills/ 目录：15 个子目录、该层无 SKILL.md；glob **/SKILL.md 得 15 个且全部位于 skills/<name>/SKILL.md。重读 hooks/session-start.sh 确认 META_SKILL 指向 using-n8n-mcp-skills，重读 .claude-plugin/marketplace.json 确认同一 bundle 枚举 15 条路径——router 即入口，选它作路径。"
      },
      {
        "item": "official_desc 逐字",
        "status": "ok",
        "detail": "重读 skills/using-n8n-mcp-skills/SKILL.md L2-4：description 为单行长文本，正文 L6 才是标题，说明未使用 YAML 折行，逐字转录无拼接误差。"
      },
      {
        "item": "external_deps：MCP 端点与两种接入方式",
        "status": "ok",
        "detail": "重读 mcp.json 全 9 行（streamable-http + https://api.n8n-mcp.com/mcp）、.mcp.json.example（npx + MCP_MODE=stdio + N8N_API_URL/N8N_API_KEY 占位）、SKILL.md 的 Hosted/Self-hosted 两段。端点、命令、变量名逐字一致。"
      },
      {
        "item": "security：hooks 是否联网",
        "status": "ok",
        "detail": "对 hooks/ 全目录独立 grep（curl|wget|nc |/dev/tcp|eval |base64|N8N_API|API_KEY|TOKEN|\\.env）：仅命中提醒文本里的 tokens 字样。逐行重读 _emit.sh 与 session-start.sh 确认无子进程下载、无网络命令。结论不变：hooks 不联网。"
      },
      {
        "item": "security：hooks 读取的环境变量集合",
        "status": "ok",
        "detail": "重读 session-start.sh（CLAUDE_PLUGIN_ROOT、HOME、TMPDIR、stdin）与 _emit.sh（TMPDIR、stdin，无 jq 时 python3 兜底）；全仓 grep keychain 零命中，`\\.claude` 仅命中 .gitignore 与文档安装指令。"
      },
      {
        "item": "security：写文件路径",
        "status": "ok",
        "detail": "重读 _emit.sh 的 STATE_DIR/MARKER/touch、get-node.sh 的同名目录、session-start.sh 的 CACHE_DIR + mkdir 与 rm -f 清理：写路径只有 ${TMPDIR:-/tmp}/n8n-mcp-skills-state/*.loaded（约定前缀）与 ~/.cache/n8n-mcp-skills（仅建目录），另有 build.sh 的 dist/。"
      },
      {
        "item": "去重策略：通用一次 vs 节点级每次",
        "status": "ok",
        "detail": "重读 _emit.sh（有 marker 即 exit 0）与 get-node.sh（通用提醒走 has_marker 去重，高危节点分支无 marker 检查）。题面所述『节点级提醒不去重』在源码注释与逻辑上均成立。"
      },
      {
        "item": "披露 vs 实际：评估套件能否运行",
        "status": "discrepancy",
        "detail": "README 写 `npm test` 与 `claude-code --skill n8n-expression-syntax \"Test webhook data access\"`，但全仓无 package.json、无测试框架配置、无 CI workflow；evaluations/ 下 57 个 JSON 只有 id/skills/query/expected_behavior 字段，无 runner；docs/DEVELOPMENT.md 自述 `*Coming soon: Evaluation framework*`。README 的注释行也写着 `# Run evaluations (if testing framework available)`——即该命令在仓内无法兑现，评估实为人工对照流程。"
      },
      {
        "item": "披露 vs 实际：npm 包与插件安装方式",
        "status": "discrepancy",
        "detail": "CLAUDE.md 提到 `npm install @anthropic/claude-code-plugin-n8n-skills`，而 .claude-plugin/marketplace.json 与 README 给出的安装方式是 `/plugin install czlonkowski/n8n-skills`，仓库内无 package.json 或发布元数据，无法在仓内证实该 npm 包存在或由本仓发布。"
      },
      {
        "item": "统计数字 vs 实测记录",
        "status": "discrepancy",
        "detail": "README 称 `525+` n8n nodes supported，而 docs/MCP_TESTING_LOG.md 记录 `\"totalNodes\": 537`（437 base + 100 langchain）；模板数 2,653+ 与日志 2653 一致。README 取下限表述，与实测不矛盾但也不精确。"
      },
      {
        "item": "技能数量口径",
        "status": "ok",
        "detail": "glob **/SKILL.md 复核共 15 个：14 个 n8n-* 专家技能 + 1 个无前缀的 router（using-n8n-mcp-skills）。与 marketplace.json 的枚举条数一致；若把 router 也算作 n8n-* 会数成 15 个 n8n-*，属口径差异，已在 analysis 中区分。"
      },
      {
        "item": "自托管为何不被 router 覆盖",
        "status": "ok",
        "detail": "重读 router SKILL.md 的技能索引与 README：self-hosting 被标注为 `Deployment, not workflow-building`，README 明说它 `triggers on its own description and is not part of the workflow-building router/hooks flow`——是刻意设计，不是遗漏。"
      },
      {
        "item": "pin 与许可证",
        "status": "ok",
        "detail": "工作副本 HEAD = 2df0f18cb52050d5b517654cc69544831aa2593c，与任务书 pin 2df0f18cb520 一致；重读 LICENSE（MIT，Copyright (c) 2025 Romuald Członkowski）与 NOTICES（11 个 hook 文件改编自 n8n-io/skills，Apache-2.0）。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "2df0f18cb52050d5b517654cc69544831aa2593c",
    "sha256": "9b92af0c1951282ed5cae63a6640e0ccb036c6d93ee5f8f986f9699e301721b8",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/n8n-workflow-skills.tar.gz",
    "sha256": "9b92af0c1951282ed5cae63a6640e0ccb036c6d93ee5f8f986f9699e301721b8",
    "commit": "2df0f18cb52050d5b517654cc69544831aa2593c"
  },
  "original": {
    "github": "https://github.com/czlonkowski/n8n-skills/tree/main/skills/using-n8n-mcp-skills",
    "path": "skills/using-n8n-mcp-skills",
    "commit": "2df0f18cb52050d5b517654cc69544831aa2593c"
  }
}