n8n-expression-syntax
Helps validate and troubleshoot n8n expression syntax for dynamic data access in workflows, ensuring correct usage of variables.
Install this skill
Security score
The n8n-expression-syntax skill was audited on May 15, 2026 and we found 24 security issues across 3 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 314 | ``` |
Webhook reference - potential data exfiltration
| 3 | description: Validate n8n expression syntax and fix common errors. Use when writing n8n expressions, using {{}} syntax, accessing $json/$node variables, troubleshooting expression errors, or working w |
Webhook reference - potential data exfiltration
| 14 | - The task involves `$json`, `$node`, webhook payloads, or expression-related workflow errors. |
Webhook reference - potential data exfiltration
| 58 | {{$node["Webhook"].json.body.email}} |
Webhook reference - potential data exfiltration
| 88 | ## 🚨 CRITICAL: Webhook Data Structure |
Webhook reference - potential data exfiltration
| 90 | **Most Common Mistake**: Webhook data is **NOT** at the root! |
Webhook reference - potential data exfiltration
| 92 | ### Webhook Node Output Structure |
Webhook reference - potential data exfiltration
| 107 | ### Correct Webhook Data Access |
Webhook reference - potential data exfiltration
| 118 | **Why**: Webhook node wraps incoming data under `.body` property to preserve headers, params, and query parameters. |
Webhook reference - potential data exfiltration
| 147 | {{$node["Respond to Webhook"].json.message}} |
Webhook reference - potential data exfiltration
| 149 | // Webhook node |
Webhook reference - potential data exfiltration
| 150 | {{$node["Webhook"].json.body.email}} |
Webhook reference - potential data exfiltration
| 191 | ### ❌ Webhook Paths |
Webhook reference - potential data exfiltration
| 195 | path: "{{$json.user_id}}/webhook" |
Webhook reference - potential data exfiltration
| 198 | path: "user-webhook" // Static paths only |
Webhook reference - potential data exfiltration
| 269 | | `{{$json.name}}` (webhook) | `{{$json.body.name}}` | |
Webhook reference - potential data exfiltration
| 278 | ### Example 1: Webhook to Slack |
Webhook reference - potential data exfiltration
| 280 | **Webhook receives**: |
Webhook reference - potential data exfiltration
| 480 | - Reference webhook data from `.body` |
Webhook reference - potential data exfiltration
| 489 | - Don't assume webhook data is at root (it's under .body!) |
Webhook reference - potential data exfiltration
| 490 | - Don't use expressions in webhook paths or credentials |
Webhook reference - potential data exfiltration
| 506 | 2. Webhook data is under `.body` |
Webhook reference - potential data exfiltration
| 513 | - `{{$json.name}}` in webhooks → Use `{{$json.body.name}}` |
External URL reference
| 160 | https://api.example.com/users/{{$json.body.user_id}} |