N8N Cli

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  src/convert/converter.ts, line 121

  fs.unlinkSync(filePath);

  src/convert/converter.ts, line 129

  fs.rmSync(dir, { recursive: true, force: true });

  src/diff/sources.ts, line 64

  fs.rmSync(tmpDir, { recursive: true, force: true });

  Show more

  src/importer/executor.ts, line 333

  fs.unlinkSync(localPath);

  src/importer/executor.ts, line 341

  fs.rmSync(oldDir, { recursive: true, force: true });

  src/importer/orphan.ts, line 32

  fs.unlinkSync(orphan.path);

  src/importer/orphan.ts, line 169

  fs.unlinkSync(filePath);

  src/importer/writer.ts, line 118

  fs.unlinkSync(tmpPath);

• Install and update

  Concern

  dependencies are not pinned.

  INSTALL_UNPINNED

  package.json, line 32

  @dagrejs/dagre

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  src/api/client.ts, line 98

  resp = await fetch(url, init);

  src/api/webhook.ts, line 54

  const resp = await fetch(url, {

  src/cli/update-check.ts, line 102

  const res = await fetch(LATEST_RELEASE_URL, {

  Show more

  src/middleware/auth/google-tokeninfo.ts, line 85

  this.fetcher = opts.fetcher ?? ((input, init) => fetch(input, init));

  src/middleware/auth/google-tokeninfo.ts, line 95

  const claim = await this.fetch(idToken);

  src/middleware/auth/google-tokeninfo.ts, line 111

  private async fetch(idToken: string): Promise<VerifiedClaim | null> {

  src/middleware/auth/jwks.ts, line 149

  this.fetcher = opts.fetcher ?? ((input, init) => fetch(input, init));

  src/middleware/builtin/authz/groups-resolver.ts, line 49

  this.fetchImpl = deps.fetch ?? ((input, init) => fetch(input, init));

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

  src/config/config.ts, line 34

  * Does NOT read .env files - direnv handles that in this project.

  src/config/config.ts, line 42

  const key = process.env.N8N_API_KEY;

  src/middleware/builtin/iap-auth/adc-impersonate-source.ts, line 65

  if (appdata) return join(appdata, "gcloud", "application_default_credentials.json");

  Show more

  src/middleware/builtin/iap-auth/adc-impersonate-source.ts, line 67

  return join(homedir(), ".config", "gcloud", "application_default_credentials.json");

  src/middleware/builtin/impersonator-token/adc-user-token-source.ts, line 31

  /** Shape of `application_default_credentials.json`. */

  src/middleware/builtin/impersonator-token/adc-user-token-source.ts, line 57

  const explicit = process.env.GOOGLE_APPLICATION_CREDENTIALS;

  src/middleware/builtin/impersonator-token/adc-user-token-source.ts, line 61

  if (appdata) return join(appdata, "gcloud", "application_default_credentials.json");

  src/middleware/builtin/impersonator-token/adc-user-token-source.ts, line 63

  return join(homedir(), ".config", "gcloud", "application_default_credentials.json");

  .claude/skills/n8n-cli/SKILL.md, line 83

  ### Checking the .env File

  .claude/skills/n8n-cli/SKILL.md, line 85

  If `.env` exists at the project root, n8n-cli can be used without specifying parameters. **Do not read the contents.**

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read. the file cap was reached before every file was read.

  OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED

  THIRD_PARTY_LICENSES.md, line 1

  # Third-Party Licenses

  bun.lock, line 1

  {

  tests/ts/node-ids.test.ts, line 1

  import { describe, expect, test } from "bun:test";

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 724f609dd75d. can delete files. dependencies are not pinned. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.

Date and source

Date checked: 20 Oct 2026

Read how this letter is chosen