n8n-code-javascript
Facilitates writing JavaScript code in n8n Code nodes for data processing and API interactions.
Install this skill
Security score
The n8n-code-javascript skill was audited on May 15, 2026 and we found 22 security issues across 3 threat categories, including 1 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 410 | const value = `${$json.field}`; |
Template literal with variable interpolation in command context
| 606 | console.log(`Processing ${items.length} items`); |
Template literal with variable interpolation in command context
| 677 | - [ ] **No n8n expressions** - Use JavaScript template literals: `` `${value}` `` |
Webhook reference - potential data exfiltration
| 37 | 4. **CRITICAL**: Webhook data is under `$json.body` (not `$json` directly) |
Webhook reference - potential data exfiltration
| 173 | const webhookData = $node["Webhook"].json; |
Webhook reference - potential data exfiltration
| 179 | webhook: webhookData, |
Webhook reference - potential data exfiltration
| 190 | ## Critical: Webhook Data Structure |
Webhook reference - potential data exfiltration
| 192 | **MOST COMMON MISTAKE**: Webhook data is nested under `.body` |
Webhook reference - potential data exfiltration
| 199 | // ✅ CORRECT - Webhook data is under .body |
Webhook reference - potential data exfiltration
| 204 | const webhookData = $input.first().json.body; |
Webhook reference - potential data exfiltration
| 205 | const name = webhookData.name; |
Webhook reference - potential data exfiltration
| 208 | **Why**: Webhook node wraps all request data under `body` property. This includes POST data, query parameters, and JSON payloads. |
Webhook reference - potential data exfiltration
| 210 | **See**: DATA_ACCESS.md for full webhook structure details |
Webhook reference - potential data exfiltration
| 289 | Combine data from multiple APIs, webhooks, or nodes |
Webhook reference - potential data exfiltration
| 442 | ### #5: Webhook Body Nesting |
Webhook reference - potential data exfiltration
| 445 | // ❌ WRONG: Direct access to webhook data |
Webhook reference - potential data exfiltration
| 448 | // ✅ CORRECT: Webhook data under .body |
Webhook reference - potential data exfiltration
| 659 | - Webhook → Code → API pattern |
Webhook reference - potential data exfiltration
| 679 | - [ ] **Webhook data** - Access via `.body` if from webhook |
External URL reference
| 465 | url: 'https://api.example.com/data', |
External URL reference
| 544 | url: 'https://api.example.com/data' |
External URL reference
| 697 | - Luxon Documentation: https://moment.github.io/luxon/ |