n8n-impl-integrations — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited n8n-impl-integrations (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
HTTP Request node configuration, authentication, pagination, response handling, and batch requests for n8n v1.x.
| Task | Solution |
|---|---|
| Call a REST API | HTTP Request node with method, URL, and authentication |
| Authenticate with API key | Predefined credential or Generic Credential (Header Auth / Query Auth) |
| Authenticate with OAuth2 | Predefined OAuth2 credential with callback URL configuration |
| Handle paginated responses | HTTP Request node pagination options (offset, cursor, or link-based) |
| Download a file | HTTP Request node with Response Format set to File |
| Send JSON body | Body Content Type = JSON, provide key-value pairs or raw JSON |
| Send form data | Body Content Type = Form-Data (multipart or URL-encoded) |
| Batch API calls | Split In Batches node before HTTP Request node |
| Handle API errors | Enable Retry On Fail and/or Continue On Fail per node |
| Access response metadata | $response.statusCode, $response.headers, $response.body |
Need to call an external API?
├── API has a built-in n8n node? → Use the dedicated node with its predefined credential
├── API uses API key?
│ ├── Key goes in header? → Generic Credential (Header Auth)
│ ├── Key goes in query string? → Generic Credential (Query Auth)
│ └── Key goes in request body? → Use HTTP Request node with expressions
├── API uses OAuth2?
│ ├── n8n has predefined OAuth2 credential? → Use it (ALWAYS preferred)
│ └── No predefined credential? → Generic OAuth2 API credential
├── API uses Basic Auth?
│ └── Generic Credential (Basic Auth) or HTTP Request Header Auth credential
└── API uses Bearer Token?
└── Generic Credential (Header Auth) with `Authorization: Bearer <token>`API returns paginated results?
├── Response includes next page URL?
│ └── Use "Response Contains Next URL" pagination mode
├── Response includes cursor/token for next page?
│ └── Use "Response Contains Next URL" with cursor parameter mapping
├── API uses offset + limit?
│ └── Use "Specify How Each Page Is Determined" with offset increment
└── API uses page numbers?
└── Use "Specify How Each Page Is Determined" with page number increment| Method | Use Case |
|---|---|
| GET | Retrieve data (NEVER include a body) |
| POST | Create resources, send data |
| PUT | Full resource replacement |
| PATCH | Partial resource update |
| DELETE | Remove resources |
| HEAD | Check resource existence without body |
https://api.example.com/v1/resourcehttps://api.example.com/v1/users/{{ $json.userId }}| Type | When to Use |
|---|---|
| JSON | REST APIs expecting JSON payloads (most common) |
| Form URL-Encoded | APIs expecting application/x-www-form-urlencoded |
| Form-Data (Multipart) | File uploads, mixed data + file payloads |
| Binary | Sending raw binary data (images, PDFs) |
| Raw | Custom content types (XML, plain text, GraphQL) |
| n8n Binary File | Sending a binary file from a previous node's output |
{{ $json.token }} or {{ $vars.apiVersion }}Content-Type explicitly when using Raw body type| Response Format | Output |
|---|---|
| JSON | Parsed JSON object in $json |
| Text | Raw text string in $json.data |
| File | Binary data attached to item (for downloads) |
| Autodetect | n8n determines format from Content-Type header |
Response metadata (available ONLY in HTTP Request node context):
$response.statusCode — HTTP status code (200, 404, etc.)$response.headers — Response headers object$response.body — Response body$response.statusMessage — Status message stringALWAYS use predefined credentials when available. n8n includes credentials for 400+ services.
Use when no predefined credential exists for your API.
| Generic Type | Injection Point |
|---|---|
| Header Auth | Custom header (e.g., X-API-Key: <value>) |
| Query Auth | URL query parameter (e.g., ?api_key=<value>) |
| Basic Auth | Authorization: Basic <base64(user:pass)> header |
| Digest Auth | HTTP Digest authentication |
| OAuth1 API | OAuth 1.0a flow |
| OAuth2 API | OAuth 2.0 flow (Authorization Code, Client Credentials) |
| Custom Auth | Arbitrary headers, query params, or body fields |
Token refresh: n8n handles token refresh automatically when Refresh Token is provided. NEVER store tokens manually in workflow logic.
Callback URL format: https://<n8n-host>/rest/oauth2-credential/callback
Enable pagination in HTTP Request node under Options > Pagination.
Mode 1: Response Contains Next URL
{{ $response.body.next }} or {{ $response.headers.link }}Mode 2: Specify How Each Page Is Determined
$pageCountALWAYS configure a stop condition:
{{ $response.body.results.length === 0 }}{{ $response.body.hasMore === false }}When sending many items to an API (rate-limited or bulk operations):
The HTTP Request node processes each input item separately by default. If you have 50 items, it makes 50 HTTP calls.
Enable in node Settings tab:
ALWAYS enable Retry On Fail for external API calls. Network issues and rate limits cause transient failures.
Enable in node Settings tab to prevent workflow failure on API errors:
$json.error with error detailsThe HTTP Request node supports an error output (second output connector):
$json.error, $json.statusCode for error detailsUse the IF node after HTTP Request to branch on status codes:
{{ $response.statusCode === 200 }} — Success path{{ $response.statusCode === 429 }} — Rate limited, needs retry/wait{{ $response.statusCode >= 400 }} — Client/server error pathFor custom APIs without a dedicated n8n node:
This pattern keeps credentials encrypted and reusable across multiple HTTP Request nodes.
$response.statusCode — ALWAYS handle non-200 responses~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.