Generated banner for N8n Validation Expert
Generated logo for N8n Validation Expert

N8n Validation Expert

Romuald CzlonkowskiCommunityCreated by Romuald Czlonkowski

  • Skill
  • Tool integration
  • Automation and integrations
  • MIT
  • No issues found

From the author

Interpret validation errors and guide fixing them. Use when encountering validation errors, validation warnings, false positives, operator structure issues, or need help understanding validation results. Also use when asking about validation profiles, error types, the validation loop process, or auto-fix capabilities. Consult this skill whenever a validate_node or validate_workflow call returns errors or warnings — it knows which warnings are false positives and which errors need real fixes.
— the description by Romuald Czlonkowski

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The n8n-validation-expert skill provides a structured approach to managing workflow validation. It emphasizes an iterative validation loop, where users perform multiple cycles of validation and correction to achieve a stable workflow. The skill covers error severity levels, explains the four validation profiles (minimal, runtime, ai-friendly, strict), and details how to handle common error types, auto-sanitization, and false positives. It also provides strategies for testing workflows and performing comprehensive audits on existing configurations.

What it does

  • Interprets and explains validation errors and warnings returned by n8n.
  • Provides guidance on fixing common issues like missing fields, type mismatches, and broken references.
  • Explains how to use different validation profiles to balance strictness and advisory feedback.
  • Details the auto-sanitization process for operator structures.
  • Offers strategies for testing workflows, including handling triggers and pinned data.
  • Provides a framework for auditing existing workflows for security and best practices.

When to use it

  • When a validate_node or validate_workflow call returns errors or warnings.
  • When encountering unexpected validation results or potential false positives.
  • When hardening a production-critical workflow using strict validation profiles.
  • When troubleshooting workflow execution failures related to configuration.
  • When reviewing an existing workflow for potential improvements or security risks.

Advantages

  • Reduces time spent debugging by providing clear, actionable fix guidance.
  • Helps distinguish between critical errors that block execution and optional best-practice warnings.
  • Standardizes the validation process through an iterative, proven loop.
  • Clarifies the use of validation profiles to suit different development stages.
  • Provides specific strategies for handling complex scenarios like cycles and disconnected nodes.

Usage examples

“I am getting a 'missing_required' error on my Slack node. How do I fix it?”
The agent will explain that a required field is missing, suggest using get_node to identify the specific field, and guide you through providing the necessary value.
“My workflow validates but I am getting a warning about 'best_practice'. Should I fix it?”
The agent will explain that best-practice warnings are optional, help you evaluate the trade-offs based on your specific use case, and advise whether to address it or accept it.
“How do I use the strict profile to harden my production workflow?”
The agent will explain how to configure the validation call to use the 'strict' profile and what additional checks, such as leftover-property detection, will be performed.
“I have a workflow that validates but fails at runtime. What should I do?”
The agent will guide you through testing strategies, such as using n8n_test_workflow with pinned data or direct execution, to isolate the issue.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/czlonkowski/n8n-validation-expert/download
  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip n8n-validation-expert.zip -d .agents/skills

Documentation by Romuald Czlonkowski

n8n Validation Expert

Expert guide for interpreting and fixing n8n validation errors.


Validation Philosophy

Validate early, validate often

Validation is typically iterative:

  • Expect validation feedback loops

  • Usually 2-3 validate → fix cycles

  • Average: 23s thinking about errors, 58s fixing them

Key insight: Validation is an iterative process, not one-shot!


Error Severity Levels

1. Errors (Must Fix)

Blocks workflow execution - Must be resolved before activation

Types:

  • missing_required - Required field not provided

  • invalid_value - Value doesn't match allowed options

  • type_mismatch - Wrong data type (string instead of number)

  • invalid_reference - Referenced node doesn't exist

  • invalid_expression - Expression syntax error

Example:

{
  "type": "missing_required",
  "property": "channel",
  "message": "Channel name is required",
  "fix": "Provide a channel name (lowercase, no spaces, 1-80 characters)"
}
2. Warnings (Should Fix)

Doesn't block execution - Workflow can be activated but may have issues

Types:

  • best_practice - Recommended but not required — surfaces under ai-friendly / strict only

  • deprecated - Using old API/feature — surfaces under every profile

  • security - Hardcoded secrets, unauthenticated webhooks — surfaces under every profile

  • performance - Potential performance issue — advisory, ai-friendly / strict

Example (best-practice — appears under ai-friendly / strict):

{
  "type": "warning",
  "nodeName": "Slack",
  "message": "Slack API can have rate limits and transient failures"
}
3. Suggestions (Optional)

Nice to have - Improvements that could enhance workflow

Types:

  • optimization - Could be more efficient

  • alternative - Better way to achieve same result


The Validation Loop

Pattern from Telemetry

7,841 occurrences of this pattern:

1. Configure node
   ↓
2. validate_node (23 seconds thinking about errors)
   ↓
3. Read error messages carefully
   ↓
4. Fix errors
   ↓
5. validate_node again (58 seconds fixing)
   ↓
6. Repeat until valid (usually 2-3 iterations)
Example
// Iteration 1
let config = {
  resource: "channel",
  operation: "create"
};

const result1 = validate_node({
  nodeType: "nodes-base.slack",
  config,
  profile: "runtime"
});
// → Error: Missing "name"

// ⏱️  23 seconds thinking...

// Iteration 2
config.name = "general";

const result2 = validate_node({
  nodeType: "nodes-base.slack",
  config,
  profile: "runtime"
});
// → Error: Missing "text"

// ⏱️  58 seconds fixing...

// Iteration 3
config.text = "Hello!";

const result3 = validate_node({
  nodeType: "nodes-base.slack",
  config,
  profile: "runtime"
});
// → Valid! ✅

This is normal! Don't be discouraged by multiple iterations.


Validation Profiles

The four profiles are cumulative (n8n-mcp ≥ 2.63.0): each surfaces everything the lower one does, plus more. The dividing line is best-practice advisories — minimal and runtime withhold them; ai-friendly and strict add them. Errors are the same across every profile except that minimal skips a few config-level checks (e.g. enum validation of an explicit operation). Security and deprecation warnings surface under every profile.

minimal

Use when: Quick structural checks while wiring a workflow together.

Surfaces: hard errors that would stop execution (missing required fields, empty code, broken connections). Skips enum checks and all advisories.

Fastest and most permissive.

Use when: Ongoing validation as you build; the everyday profile.

Surfaces: errors (required fields, value types, allowed values, dependencies, broken references) plus security and deprecation warnings. No best-practice advisories.

Balanced — catches everything that breaks, stays quiet about style.

ai-friendly

Use when: You want the best-practice advice before deploying.

Surfaces: everything runtime does, plus best-practice advisories — per-node "without error handling" suggestions, "webhook should always send a response", rate-limit notes, outdated-typeVersion suggestions, cachedResultName and long-chain hints.

Note: ai-friendly is stricter than runtime, not looser. (Older docs described it as reducing false positives — that was true only while profile gating was broken; it is fixed now.)

strict

Use when: Hardening a production-critical workflow.

Surfaces: everything ai-friendly does, plus leftover-property checks ("property 'X' won't be used — not visible with current settings").

Maximum lint. With the false positives fixed at the source, its warnings are advice to weigh, not noise to fight.


Common Error Types

Five core error types, in rough order of frequency:

  • missing_required — a required field isn't provided. Use get_node to see required fields, then add it.

  • invalid_value — value doesn't match allowed options (enums are case-sensitive). Check the error's allowed list or get_node.

  • type_mismatch — wrong data type (string "100" vs number 100). Convert to the expected type.

  • invalid_expression — expression syntax error (missing {{}}, typos). See the n8n Expression Syntax skill.

  • invalid_reference — referenced node doesn't exist (renamed, deleted, or misspelled). Fix the name or cleanStaleConnections.

A sixth class, patchNodeField errors (find-not-found, ambiguous match, invalid/unsafe regex), surfaces when a patchNodeField op fails during n8n_update_partial_workflow — it's strict by design and errors rather than silently continuing.

Every type above has worked examples (broken config → fix) plus the patchNodeField error cases and their fixes in ERROR_CATALOG.md.


Auto-Sanitization System

Automatically normalizes common operator structures on ANY workflow update — n8n_create_workflow, n8n_update_partial_workflow, or any save. Trust it; don't hand-fix these.

What it normalizes on save:

  • Binary operators (equals, notEquals, contains, notContains, greaterThan, lessThan, startsWith, endsWith) — removes a stray singleValue property.

  • Unary operators (isEmpty, isNotEmpty, true, false) — adds singleValue: true.

  • IF/Switch metadata — fills in conditions.options for IF v2.2+ and Switch v3.2+.

Validation no longer errors on these shapes (n8n-mcp ≥ 2.63.0). n8n derives unary-ness from the operator name and defaults the conditions.options sub-fields, so validate_node / validate_workflow accept a condition whether or not singleValue and the options metadata are present — the sanitizer just tidies the canonical form on save. (Older servers wrongly errored on the un-normalized shape; if you see that, upgrade.) What still is a real error: a v1-shaped conditions object on a v2 node, an empty filter with no conditions, and legacy v1 operator names (e.g. smaller) inside a v2 structure.

What the sanitizer CANNOT fix (handle manually): broken connections to non-existent nodes (use cleanStaleConnections), branch-count mismatches (add/remove connections or rules), and paradoxical corrupt states (may need manual DB intervention).

Before/after examples and the full cannot-fix detail are in ERROR_CATALOG.md (Auto-Sanitization sections).


False Positives

The validator overhaul (n8n-mcp ≥ 2.63.0) removed the classic false positives — template literals inside expressions, optional chaining, omitted-operation defaults, the Webhook → Respond-to-Webhook pattern, IF/Filter legacy shapes, and more no longer fire.

Known exceptions (n8n-mcp 2.85.0, reported upstream; re-check after upgrading):

  • ERROR "Incorrect error output configuration… appear to be error handlers but are in main[0]" on a fan-out where one target is a Respond to Webhook or Send Email node, or has error / fail / catch / exception in its name. Moving Respond to Webhook onto main[1], as suggested, means the webhook only answers when the upstream node fails. Treat it as a false positive only when the message matches this text exactly and you've inspected connections and confirmed the named node sits on the success path by design. In that case keep the wiring, say in your reply that you're ignoring n8n-mcp#1111 and why, and don't run n8n_autofix_workflow with the default fix types (exclude error-output-config, or it may rewire the success path). Every other valid: false error still gets fixed. (n8n-mcp#1111)

  • Warning "Possible missing $ prefix" on json/items inside a string, e.g. $jmespath($('X').all(), "[?json.country=='PL'].json.name"). The json. prefix is required there, so ignore the warning. (#1115)

  • validate_node on a language: "pythonNative" Code node → "Code cannot be empty" (jsCode). The error is false; validate the workflow instead. (#1112)

  • Python "Return value must be a list of dicts" for a single-dict return in all-items mode. n8n accepts it and emits one item. (#1113)

Blind spots (valid workflow, wrong result at runtime): $jmespath syntax/quoting mistakes inside expressions (#1114); any JS error inside {{ }}, which resolves to null while the execution stays green (see n8n-expression-syntax); native-Python mistakes such as legacy _input/_json, dot access, blocked imports and classes (#1113, see n8n-code-python). Validation plus a successful run still isn't proof: inspect the output values.

What remains are best-practice advisories (surfaced only under ai-friendly / strict) that flag a real trade-off but may be acceptable in your case. Not every advisory needs a fix — many are context-dependent. Common ones and when each is acceptable vs. worth fixing:

  • "...without error handling" — OK for dev/testing and non-critical notifications; fix for production handling important data. (Never a hard error — style doesn't block execution.)

  • "No retry logic" — OK for idempotent ops, APIs with their own retry, manual triggers; fix for flaky external services and production automation.

  • "...rate limits and transient failures" — OK for internal/low-volume/server-side-limited APIs; fix for public, high-volume APIs.

  • "Unbounded query" — OK for small known datasets, aggregations, dev/testing; fix for production queries on large tables.

Security and deprecation warnings, by contrast, surface under every profile and should be treated as real.

Full per-case guidance, the list of what the validator no longer flags, profile strategies, the "should I fix this?" decision framework, and how to document accepted advisories are in FALSE_POSITIVES.md.


Validation Result Structure

Complete Response
{
  "valid": false,
  "errors": [
    {
      "type": "missing_required",
      "property": "channel",
      "message": "Channel name is required",
      "fix": "Provide a channel name (lowercase, no spaces)"
    }
  ],
  "warnings": [
    {
      "type": "best_practice",
      "property": "errorHandling",
      "message": "Slack API can have rate limits",
      "suggestion": "Add onError: 'continueRegularOutput'"
    }
  ],
  "suggestions": [
    {
      "type": "optimization",
      "message": "Consider using batch operations for multiple messages"
    }
  ],
  "summary": {
    "hasErrors": true,
    "errorCount": 1,
    "warningCount": 1,
    "suggestionCount": 1
  }
}
How to Read It
  1. Check valid first — true means the config is valid; false means there are errors to fix before deployment.

  2. Fix errors first — each carries a property, message, and fix. These must be resolved.

  3. Review warnings — each has a message and suggestion; decide per-case whether to address it (see False Positives above).

  4. Consider suggestions — optional improvements, not required.


Workflow Validation

validate_workflow (Structure)

Validates entire workflow, not just individual nodes

Checks:

  1. Node configurations - Each node valid

  2. Connections - No broken references

  3. Expressions - Syntax and references valid

  4. Flow - Logical workflow structure

Example:

validate_workflow({
  workflow: {
    nodes: [...],
    connections: {...}
  },
  options: {
    validateNodes: true,
    validateConnections: true,
    validateExpressions: true,
    profile: "runtime"
  }
})
Common Workflow Errors
1. Broken Connections
{
  "error": "Connection from 'Transform' to 'NonExistent' - target node not found"
}

Fix: Remove stale connection or create missing node

2. Cycles (warning, not an error)
{
  "warning": "Workflow contains a cycle: Node A → Node B → Node A"
}

A cycle is a warning, not a hard error (n8n-mcp ≥ 2.63.0) — runtime-controlled loops (error-retry, data-driven pagination, a router feeding back) execute to completion and are legitimate. Fix only if the loop is unintentional: ensure the cycle has a real exit (a conditional node, an error output, or a bounded counter) so it can't spin forever.

3. Multiple Start Nodes
{
  "warning": "Multiple trigger nodes found - only one will execute"
}

Fix: Remove extra triggers or split into separate workflows

4. Disconnected Nodes
{
  "warning": "Node 'Transform' is not connected to workflow flow"
}

Fix: Connect node or remove if unused


Recovery Strategies

Strategy 1: Start Fresh

When: Configuration is severely broken

Steps:

  1. Note required fields from get_node

  2. Create minimal valid configuration

  3. Add features incrementally

  4. Validate after each addition

When: Workflow validates but executes incorrectly

Steps:

  1. Remove half the nodes

  2. Validate and test

  3. If works: problem is in removed nodes

  4. If fails: problem is in remaining nodes

  5. Repeat until problem isolated

Strategy 3: Clean Stale Connections

When: "Node not found" errors

Steps:

n8n_update_partial_workflow({
  id: "workflow-id",
  operations: [{
    type: "cleanStaleConnections"
  }]
})
Strategy 4: Use Auto-fix

When: Validation errors that can be automatically resolved

Steps:

// Preview fixes (default - doesn't apply)
n8n_autofix_workflow({
  id: "workflow-id",
  applyFixes: false,
  confidenceThreshold: "medium"  // high, medium, low
})

// Review fixes, then apply
n8n_autofix_workflow({
  id: "workflow-id",
  applyFixes: true
})

Auto-Fix Capabilities

The n8n_autofix_workflow tool can fix these issue types:

  1. expression-format - Missing = prefix in expressions (e.g., {{ $json.field }} → ={{ $json.field }})

  2. typeversion-correction - Downgrades nodes with unsupported typeVersions

  3. error-output-config - Removes conflicting onError settings

  4. node-type-correction - Fixes unknown node types using similarity matching (90%+ confidence)

  5. webhook-missing-path - Generates UUIDs for webhook nodes missing path configuration

  6. typeversion-upgrade - Smart upgrades to latest node versions with auto-migration

  7. version-migration - Guidance for complex breaking changes requiring manual steps

Confidence levels: high (90%+, safe to auto-apply), medium (70-89%, review recommended), low (<70%, manual review required)

// Preview all fixes
n8n_autofix_workflow({id: "workflow-id"})

// Only apply high-confidence fixes
n8n_autofix_workflow({
  id: "workflow-id",
  applyFixes: true,
  confidenceThreshold: "high"
})

// Target specific fix types
n8n_autofix_workflow({
  id: "workflow-id",
  fixTypes: ["expression-format", "typeversion-upgrade"],
  applyFixes: true
})

Post-update guidance: For version upgrades, check the postUpdateGuidance field in the response for step-by-step migration instructions.


Best Practices

✅ Do
  • Validate after every significant change

  • Read error messages completely

  • Fix errors iteratively (one at a time)

  • Use runtime profile for pre-deployment

  • Check valid field before assuming success

  • Trust auto-sanitization for operator issues

  • Use get_node when unclear about requirements

  • Document false positives you accept

❌ Don't
  • Skip validation before activation

  • Try to fix all errors at once

  • Ignore error messages

  • Use strict profile during development (too noisy)

  • Assume validation passed (always check result)

  • Manually fix auto-sanitization issues

  • Deploy with unresolved errors

  • Ignore all warnings (some are important!)


Running the workflow after it validates

validate_workflow checks structure, parameters and expressions — it never runs anything. A workflow that validates cleanly can still fail on real data, so run it once before calling it done.

With a webhook, form or chat trigger: n8n_test_workflow({workflowId}) — the default method: "auto" detects the trigger and fires it over HTTP (the workflow must be active).

Without such a trigger (Manual Trigger, Schedule, sub-workflow) there is no HTTP entry point. Use the pin-data path, which runs through n8n's own MCP server (N8N_MCP_ACCESS_TOKEN, n8n 2.34+):

  1. n8n_test_workflow({workflowId, method: "prepare"}) — lists the nodes that need pinned data.

  2. Build one sample item per listed node, keyed by node name, each item wrapped in {json: {...}}:

    {"When clicking 'Test workflow'": [{"json": {"orderId": "1234", "email": "[email protected]"}}]}

    A flat object instead of an array of {json} items is the usual mistake here.

  3. n8n_test_workflow({workflowId, method: "pinned", pinData}) — runs it with that data and waits for the result.

For a quick manual run without pinned data, method: "direct" starts a manual execution and returns as soon as it has started; poll n8n_executions({action: "get", id: executionId, mode: "error"}) for the outcome. Nothing is pinned on a direct run, so every node executes and any external call it makes is real — and even pinned only pins trigger, credentialed and HTTP Request nodes. executionMode: "production" changes the execution context, not whether there are side effects; leave it at the default unless the user asked for a production run.

method: "auto" never runs a workflow through n8n's MCP server. On a workflow with no external trigger it reports that fact and names prepare/pinned/direct; the routed methods only run when you ask for them by name.

Consent before the first routed run. n8n refuses these calls for a workflow whose "Available in MCP" setting is off, which comes back as WORKFLOW_NOT_EXPOSED. Re-running with exposeToMcp: true turns that setting on and retries once. It is a visible, persistent setting on the workflow (and enabling it is a workflow update, so a concurrent UI edit can be overwritten) — ask the user before passing it. The consent flow only ever enables the setting; nothing disables it implicitly. Turning it off again is a deliberate act: n8n_update_partial_workflow({id: workflowId, operations: [{type: "updateSettings", settings: {availableInMCP: false}}]}), or the toggle in the n8n UI.

Reading the result: a run that started and then failed comes back as EXECUTION_FAILED with the executionId — inspect it with n8n_executions({action: "get", id, mode: "error"}) and fix from the node that threw, then validate and run again.


Reviewing an existing workflow

Validating as you build (the loop above) is for catching schema and shape errors in your own in-progress work. Reviewing an existing workflow — yours or one you've been handed — is a different job: the workflow already passes validate_workflow clean, and you're hunting for the issues validation doesn't see (silent connection bugs, injection-prone queries, dropped-item Switches, Set/Code antipatterns, missing error paths). For that, pull the workflow with n8n_get_workflow and walk REVIEW_CHECKLIST.md — a severity-tiered audit (MUST FIX / SHOULD FIX / NICE TO HAVE) where every item points to the canonical skill for the fix. Run n8n_audit_instance alongside it to surface hardcoded secrets and unauthenticated webhooks across the whole instance.


Detailed Guides

For comprehensive error catalogs, false positives, and workflow review:


Summary

Key Points:

  1. Validation is iterative (avg 2-3 cycles, 23s + 58s)

  2. Errors must be fixed, warnings are optional

  3. Auto-sanitization normalizes operator structures on save; validation no longer errors on the raw shape

  4. Use runtime profile by default; step up to ai-friendly/strict for best-practice advisories

  5. Classic false positives are fixed (≥ 2.63.0) — remaining warnings are advisories or security/deprecation notices, not validator mistakes

  6. Read error messages - they contain fix guidance

Validation Process:

  1. Validate → Read errors → Fix → Validate again

  2. Repeat until valid (usually 2-3 iterations)

  3. Review warnings and decide if acceptable

  4. Deploy with confidence

Related Skills & Tools:

  • n8n MCP Tools Expert - Use validation tools correctly

  • n8n Expression Syntax - Fix expression errors

  • n8n Node Configuration - Understand required fields

  • n8n_audit_instance - Proactive security validation (hardcoded secrets, unauthenticated webhooks, missing error handling, data retention)

Files

REVIEW_CHECKLIST.md

Workflow Review Checklist

A severity-tiered audit for reviewing an existing n8n workflow — yours or anyone's. This is different from the validate-as-you-build loop in the main skill: that loop catches schema and shape errors with validate_node / validate_workflow; this checklist catches the silent issues those tools pass clean — antipatterns, security holes, broken-but-valid connections, and missing error paths.

How to use

Pull the workflow first, then walk the list top to bottom. For each item, inspect the actual JSON and decide if it applies. Report findings grouped by severity, each pointing at the canonical skill for the why and the fix.

You're reviewing JSON, not source. n8n_get_workflow returns nodes (with parameters, credentials, type strings like nodes-base.httpRequest) and a connections graph. Phrase findings in JSON terms: "node Route order has no parameters.options.fallbackOutput, so unmatched items drop."

Bare NODE_FAMILY_GOTCHAS.md references in the lists below all point to n8n-node-configuration/NODE_FAMILY_GOTCHAS.md.

SeverityMeaningAction
MUST FIXShip-blocker: security hole, broken connection, production-breaking bug.If the workflow is active, stop it; fix before re-enabling.
SHOULD FIXReal issue: antipattern, missing error handling on a production path, broken contract.Fix in the next change.
NICE TO HAVEPolish: naming, descriptions, readability.Clean up opportunistically.

A review agent should not auto-fix MUST FIX items without user confirmation — security and connection changes have blast radius. Surface the finding, propose the fix, wait for approval.

Contents

  • Cross-cutting first

  • MUST FIX

  • SHOULD FIX

  • NICE TO HAVE

  • Reporting findings


Cross-cutting first

  • [ ] Pull the workflow. n8n_get_workflow({ id }) so every check runs on real JSON, not assumptions. Use structure mode for a fast graph read, full when you need parameters, and filtered + nodeNames to read a single heavy node (e.g. a long Code node) on a large workflow that would otherwise truncate client-side when fetched whole.

  • [ ] Logic smell test. Trace the happy path once, top to bottom. Does the structure match the workflow's stated purpose? Anything dead, contradictory, or out of place (a write node in a "read-only" flow, a fan-out branch wired nowhere, an HTTP call to an unrelated domain)? → n8n-workflow-patterns

  • [ ] Note the trigger type and whether it's active. Severity shifts with both: a webhook/API or unattended schedule needs error paths a manual run doesn't, and an active workflow with broken connections is higher severity.


MUST FIX

Credentials and secrets
  • [ ] Tokens / API keys / passwords in node text fields (Bearer xxx, sk-... typed into an HTTP header value, a query param, or any parameter). The credential system is the only correct home. Use n8n_manage_credentials to inspect/migrate. → n8n-mcp-tools-expert (credential management)

  • [ ] Secrets stored in Set node values for later {{ $json.token }} referencing. The secret is in the workflow JSON regardless of how it's read. → n8n-mcp-tools-expert

  • [ ] Hardcoded credentials inside Code nodes. Same leak surface as text fields. → n8n-code-javascript / n8n-code-python (anti-patterns)

  • [ ] Placeholder credential IDs ("id": "REPLACE_ME") left in the credentials block. n8n renders a permanently disabled selector for unknown IDs. Omit the block when the real ID is unknown. → n8n-node-configuration

Run n8n_audit_instance to surface hardcoded secrets and unauthenticated webhooks across the instance automatically. → n8n-validation-expert

SQL / query injection
  • [ ] User input interpolated into a query string. Any DB node with {{ ... }} inside parameters.query — n8n substitutes it into the SQL before the driver binds parameters, so it's an injection vector. Use $1, $2 placeholders + parameters.options.queryReplacement (Postgres/MySQL); object filters for Mongo. → n8n-node-configuration → NODE_FAMILY_GOTCHAS.md (Database)

Connection bugs (valid but broken)
  • [ ] Merge with 3+ sources but numberInputs still 2 (or set under the wrong name numberOfInputs, which is ignored). Third source silently drops. → n8n-node-configuration → NODE_FAMILY_GOTCHAS.md (Merge)

  • [ ] Merge index off-by-one. parameters.useDataOfInput is 1-indexed; the wire sits at connections.<source>.main[N-1]. Mismatch passes through the wrong source silently. Verify with n8n_get_workflow. → n8n-node-configuration → NODE_FAMILY_GOTCHAS.md (Merge)

  • [ ] Error output enabled but unwired, or wired but not enabled. If parameters.onError is continueErrorOutput but the node's error output is empty, failed items are silently dropped; if a node feeds an error branch but onError isn't set, the branch is unreachable and a failure halts the workflow. validate_workflow now surfaces both as warnings (n8n-mcp ≥ 2.63.0), but neither flips valid:false, so this stays a review item. Locate the error output by node type: it is the last main[] slot after the node's natural outputs — main[1] on a single-output node like HTTP Request, but main[2] on an IF (whose main[1] is the normal false branch) and similarly on Switch/Split In Batches. Don't mistake a wired second branch on a multi-output node for an unwired error output. → n8n-validation-expert

Switch
  • [ ] No fallback output. Without parameters.options.fallbackOutput: "extra", unmatched items drop silently. → n8n-node-configuration → NODE_FAMILY_GOTCHAS.md (Switch)

Webhook API workflows
  • [ ] Webhook performing a sensitive action with parameters.authentication: "none". "Sensitive" = mutates state, sends external messages, hits production data, triggers paid actions. Anyone with the URL can fire it. Set authentication to basicAuth/headerAuth with a matching credential. → n8n-workflow-patterns (webhook), n8n-mcp-tools-expert (credentials)

  • [ ] Error branch returns HTTP 200. options.responseCode defaults to 200 on every Respond node, including error paths — and a top-level responseCode is ignored, so check where it's set. The caller sees success while the body says failure. → n8n-node-configuration → NODE_FAMILY_GOTCHAS.md (Webhook)


SHOULD FIX

Set-node antipattern
  • [ ] Set node that only re-maps fields for the next node. The most common antipattern. Delete it and inline the expressions at the consumer. Keep Edit Fields when it creates something: a constant item, an error or return item (incl. a sub-workflow's final Return node), a payload object, or a value several nodes read. → n8n-expression-syntax ("The Set-node antipattern and branch convergence")

  • [ ] Set node building an email / Slack body. Build the body inline in the comms node's body field. → n8n-expression-syntax

  • [ ] Set node mapping fields right before a write node. Map directly in the write node's per-field expression slots. → n8n-node-configuration

  • [ ] Multiple consecutive Set nodes each defining one field. Collapse into one, or eliminate. → n8n-expression-syntax

Code-node antipattern
  • [ ] Code node doing a native-node job. Filtering (Filter), routing (IF / Switch), totals (Summarize), top-N (Sort + Limit), dedupe (Remove Duplicates), joins (Merge), diffs (Compare Datasets), arrays (Split Out / Aggregate), dates (Date & Time), API paging (HTTP Request pagination), or single-item shaping (short expressions in the consumer). Check the job-to-node table in using-n8n-mcp-skills; configs in n8n-node-configuration → NATIVE_NODES.md.

  • [ ] Code or HTTP Request node without a Why Code: / Why HTTP: note. A Code node that stays must be on the closed list (loops or recursion no node expresses, state across runs, parsing no node handles, a library, heavy all-items work, one short node replacing 4+ glue nodes) and say so in notes. → n8n-code-javascript

  • [ ] Function body inside {{ }} in a non-Code node ((() => { … })()). Several statements in an expression are code: a native node plus short expressions, or a Code node with a Why Code: note. → n8n-expression-syntax (the transform gatekeeper)

  • [ ] Code node using crypto.createHash / crypto.createHmac. Use the native Crypto node (nodes-base.crypto). Recurring slip. → n8n-code-javascript

  • [ ] Code node parsing XML / SOAP / RSS. Use the native XML node (nodes-base.xml) + Edit Fields for extraction. → n8n-code-javascript

  • [ ] HMAC verified over JSON.stringify($json.body). Valid signatures fail. Webhook options.rawBody: true + Crypto (typeVersion 2, binaryData: true, secret from a crypto credential). → n8n-node-configuration → NATIVE_NODES.md

  • [ ] Python Code node where JS would do. Use Python only when the user asked for it: native Python has no n8n helpers and, by default, no imports (not even json/re/datetime). Also flag legacy _input/_json/_node/_now usage or item.json.x dot access. Those fail on n8n 2.x. → n8n-code-python

Expression discipline
  • [ ] $json.x deep in a branchy / multi-step workflow. Switch to $('Source Node').item.json.x for refactor stability; the $json form breaks silently when an intermediate is inserted or context is cleared. → n8n-expression-syntax (non-negotiable)

  • [ ] Branches converge with $json references downstream. Whichever branch fired last wins, non-deterministically. Insert a NoOp (Combine Inputs) at the merge and reference it by name; use a Set to normalize if the branch shapes differ. → n8n-expression-syntax

  • [ ] Date & Time node without options.includeInputFields: true where downstream nodes still need the item's other fields — they're dropped. (The node itself is fine; so is an inline Luxon one-liner.) → n8n-node-configuration → NATIVE_NODES.md

  • [ ] $env.X in any expression. Doesn't work, throws at runtime. Use $vars.X (paid plans), a Data Table, or a credential for secrets. → n8n-expression-syntax

  • [ ] .all().map()/filter()/reduce() aggregation without executeOnce: true on the node. It re-runs the full aggregation per input item — wasted work, and N identical outputs where one was expected. (Leave executeOnce off when .all() is a per-item lookup keyed by the current item.) → n8n-expression-syntax

Slack / comms
  • [ ] Block Kit passed as a bare array. Posts as plain text, silently. Wrap as ={{ { "blocks": ... } }}. → n8n-node-configuration → NODE_FAMILY_GOTCHAS.md (Slack)

  • [ ] Thread reply posting as a top-level message — thread_ts not set or in the wrong place. → n8n-node-configuration → NODE_FAMILY_GOTCHAS.md (Slack)

  • [ ] Operation set from the UI display name ("send") rather than the internal value ("post"). Confirm with get_node. → n8n-node-configuration

Database
  • [ ] select / query with no-match path feeding an IF, but alwaysOutputData not set. No match = zero items = the IF never fires. → n8n-node-configuration → NODE_FAMILY_GOTCHAS.md (Database)

  • [ ] Multi-step writes needing atomicity split across nodes. No cross-node transaction exists; collapse into one executeQuery with options.queryBatching: "transaction". → n8n-node-configuration → NODE_FAMILY_GOTCHAS.md (Database)

  • [ ] Write node (INSERT/UPDATE/DELETE) followed by a node expecting its output, without alwaysOutputData. Writes often return 0 items and stall the chain. → n8n-node-configuration

Webhook / Respond to Webhook
  • [ ] responseMode left at onReceived for a request/response API. Caller never sees the computed result; use responseNode. → n8n-node-configuration → NODE_FAMILY_GOTCHAS.md (Webhook)

  • [ ] Generic 500 for every failure. Map status codes: 400 validation, 401/403 auth, 409 conflict, 429 rate limit. → n8n-node-configuration

  • [ ] respondWith: "json" body built with JSON.stringify(...). Double-encodes. Pass the object literal in expression mode. → n8n-node-configuration → NODE_FAMILY_GOTCHAS.md (Webhook)

  • [ ] Fallible nodes (HTTP/DB/API) on a webhook path with no error branch. A failure halts the workflow and the caller gets n8n's generic error. Wire onError: "continueErrorOutput" + a 5xx Respond, and validate the wiring. → n8n-error-handling, n8n-workflow-patterns (webhook)

HTTP Request
  • [ ] Auth header typed into headerParameters instead of a credential. Use Bearer Auth / Header Auth credentials. → n8n-node-configuration, n8n-mcp-tools-expert

  • [ ] Headers set via both headerParameters and a credential's header auth. They conflict. → n8n-node-configuration

  • [ ] Network-calling node (HTTP/comms/DB/AI) without retryOnFail. Transient 429s and blips surface as hard failures. (Transient-failure handling folds into node config for now.) → n8n-node-configuration

Schedule trigger
  • [ ] Business-critical schedule with no explicit workflow timezone. DST and instance moves shift timing. → n8n-node-configuration → NODE_FAMILY_GOTCHAS.md (Schedule)

  • [ ] Schedule-triggered workflow not idempotent. Restarts can miss runs and re-runs can double-fire. → n8n-node-configuration → NODE_FAMILY_GOTCHAS.md (Schedule)

Structure and patterns
  • [ ] Workflow built without a recognizable pattern where one fits (webhook, HTTP API, database, AI, scheduled, batch). Reshape to the proven pattern. → n8n-workflow-patterns

  • [ ] Fan-out branches assumed to run in parallel. n8n runs them sequentially. Real concurrency needs sub-workflow dispatch. (Sub-workflow guidance is pending a dedicated skill; note the limitation for now.) → n8n-workflow-patterns

  • [ ] Large-item-count flow doing per-item work where batching/aggregation would cut overhead. → n8n-workflow-patterns

AI Agent / Code Tool (when present)
  • [ ] Custom Code Tool returning a non-string ([{json:{...}}]) or using $fromAI / $input / $helpers — none exist in the Code Tool sandbox; the return must be a string. → n8n-code-tool

  • [ ] Tool with a generic/empty name or description. The model can't tell when to call it; descriptions are part of the prompt. Use verb-first specific names. (Deeper agent guidance is pending a dedicated skill.) → n8n-code-tool


NICE TO HAVE

Naming
  • [ ] Generic node names (HTTP Request1, Set2, Postgres1). A runtime failure on Fetch order details localizes the break instantly; HTTP Request3 tells the operator nothing. Rename to describe what the node does in this workflow. → n8n-workflow-patterns

  • [ ] Workflow name not verb-first (Send weekly customer report, not Customer report sender). Sentence case, no emojis, no trailing version numbers. → n8n-workflow-patterns

Readability
  • [ ] Workflow description empty or one line. Two sentences: what it does and why it exists (the "why" is the part that otherwise gets lost). → n8n-workflow-patterns

  • [ ] Code node with no Why Code: note naming the native node considered and the closed-list reason. → n8n-code-javascript

  • [ ] Multi-line expression that isn't indented or commented. Most n8n users aren't coders — format it like real code. → n8n-expression-syntax


Reporting findings

Group by severity, then by domain. For each finding give the node(s) affected, a one-sentence description, and the canonical skill for the fix.

MUST FIX
  Security
  - Node `Send webhook`: bearer token typed into headerParameters value. -> n8n-mcp-tools-expert (credentials)
  - Node `Lookup user`: {{ $json.email }} interpolated into parameters.query. -> NODE_FAMILY_GOTCHAS.md (Database)

  Connections
  - Node `Merge customer + Stripe`: 3 sources wired but parameters.numberInputs = 2; third drops. -> NODE_FAMILY_GOTCHAS.md (Merge)

SHOULD FIX
  Set-node antipattern
  - Node `Set customer_id`: feeds one consumer; inline at `Lookup customer`. -> n8n-expression-syntax
  ...

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an MCP server, Needs Python, Needs Node.js

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
Romuald Czlonkowski
Publisher
Romuald Czlonkowski (Community)
Source
czlonkowski/n8n-skills · skills/n8n-validation-expert · commit e037563
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Romuald Czlonkowski or Romuald Czlonkowski.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download n8n-validation-expert.zip