n8n-code-javascript
Provides expert guidance for writing JavaScript code in n8n Code nodes, enhancing automation and data processing capabilities.
Install this skill
Security score
The n8n-code-javascript skill was audited on Feb 28, 2026 and we found 22 security issues across 3 threat categories, including 1 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 408 | const value = `${$json.field}`; |
Template literal with variable interpolation in command context
| 604 | console.log(`Processing ${items.length} items`); |
Template literal with variable interpolation in command context
| 675 | - [ ] **No n8n expressions** - Use JavaScript template literals: `` `${value}` `` |
Webhook reference - potential data exfiltration
| 35 | 4. **CRITICAL**: Webhook data is under `$json.body` (not `$json` directly) |
Webhook reference - potential data exfiltration
| 171 | const webhookData = $node["Webhook"].json; |
Webhook reference - potential data exfiltration
| 177 | webhook: webhookData, |
Webhook reference - potential data exfiltration
| 188 | ## Critical: Webhook Data Structure |
Webhook reference - potential data exfiltration
| 190 | **MOST COMMON MISTAKE**: Webhook data is nested under `.body` |
Webhook reference - potential data exfiltration
| 197 | // ✅ CORRECT - Webhook data is under .body |
Webhook reference - potential data exfiltration
| 202 | const webhookData = $input.first().json.body; |
Webhook reference - potential data exfiltration
| 203 | const name = webhookData.name; |
Webhook reference - potential data exfiltration
| 206 | **Why**: Webhook node wraps all request data under `body` property. This includes POST data, query parameters, and JSON payloads. |
Webhook reference - potential data exfiltration
| 208 | **See**: [DATA_ACCESS.md](DATA_ACCESS.md) for full webhook structure details |
Webhook reference - potential data exfiltration
| 287 | Combine data from multiple APIs, webhooks, or nodes |
Webhook reference - potential data exfiltration
| 440 | ### #5: Webhook Body Nesting |
Webhook reference - potential data exfiltration
| 443 | // ❌ WRONG: Direct access to webhook data |
Webhook reference - potential data exfiltration
| 446 | // ✅ CORRECT: Webhook data under .body |
Webhook reference - potential data exfiltration
| 657 | - Webhook → Code → API pattern |
Webhook reference - potential data exfiltration
| 677 | - [ ] **Webhook data** - Access via `.body` if from webhook |
External URL reference
| 463 | url: 'https://api.example.com/data', |
External URL reference
| 542 | url: 'https://api.example.com/data' |
External URL reference
| 695 | - Luxon Documentation: https://moment.github.io/luxon/ |