N8n Validation Expert
Romuald CzlonkowskiCommunityCreated by Romuald Czlonkowski
- Skill
- Tool integration
- Automation and integrations
- MIT
- No issues found
AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
The n8n-validation-expert skill provides a structured approach to managing workflow validation. It emphasizes an iterative validation loop, where users perform multiple cycles of validation and correction to achieve a stable workflow. The skill covers error severity levels, explains the four validation profiles (minimal, runtime, ai-friendly, strict), and details how to handle common error types, auto-sanitization, and false positives. It also provides strategies for testing workflows and performing comprehensive audits on existing configurations.
What it does
- Interprets and explains validation errors and warnings returned by n8n.
- Provides guidance on fixing common issues like missing fields, type mismatches, and broken references.
- Explains how to use different validation profiles to balance strictness and advisory feedback.
- Details the auto-sanitization process for operator structures.
- Offers strategies for testing workflows, including handling triggers and pinned data.
- Provides a framework for auditing existing workflows for security and best practices.
When to use it
- When a validate_node or validate_workflow call returns errors or warnings.
- When encountering unexpected validation results or potential false positives.
- When hardening a production-critical workflow using strict validation profiles.
- When troubleshooting workflow execution failures related to configuration.
- When reviewing an existing workflow for potential improvements or security risks.
Advantages
- Reduces time spent debugging by providing clear, actionable fix guidance.
- Helps distinguish between critical errors that block execution and optional best-practice warnings.
- Standardizes the validation process through an iterative, proven loop.
- Clarifies the use of validation profiles to suit different development stages.
- Provides specific strategies for handling complex scenarios like cycles and disconnected nodes.
Usage examples
- “I am getting a 'missing_required' error on my Slack node. How do I fix it?”
- The agent will explain that a required field is missing, suggest using get_node to identify the specific field, and guide you through providing the necessary value.
- “My workflow validates but I am getting a warning about 'best_practice'. Should I fix it?”
- The agent will explain that best-practice warnings are optional, help you evaluate the trade-offs based on your specific use case, and advise whether to address it or accept it.
- “How do I use the strict profile to harden my production workflow?”
- The agent will explain how to configure the validation call to use the 'strict' profile and what additional checks, such as leftover-property detection, will be performed.
- “I have a workflow that validates but fails at runtime. What should I do?”
- The agent will guide you through testing strategies, such as using n8n_test_workflow with pinned data or direct execution, to isolate the issue.
Install
Download the skill as a ZIP:
https://autogineer.com/agent-skills/czlonkowski/n8n-validation-expert/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip n8n-validation-expert.zip -d .agents/skills
Documentation by Romuald Czlonkowski
n8n Validation Expert
Expert guide for interpreting and fixing n8n validation errors.
Validation Philosophy
Validate early, validate often
Validation is typically iterative:
Expect validation feedback loops
Usually 2-3 validate → fix cycles
Average: 23s thinking about errors, 58s fixing them
Key insight: Validation is an iterative process, not one-shot!
Error Severity Levels
1. Errors (Must Fix)
Blocks workflow execution - Must be resolved before activation
Types:
missing_required- Required field not providedinvalid_value- Value doesn't match allowed optionstype_mismatch- Wrong data type (string instead of number)invalid_reference- Referenced node doesn't existinvalid_expression- Expression syntax error
Example:
{
"type": "missing_required",
"property": "channel",
"message": "Channel name is required",
"fix": "Provide a channel name (lowercase, no spaces, 1-80 characters)"
}2. Warnings (Should Fix)
Doesn't block execution - Workflow can be activated but may have issues
Types:
best_practice- Recommended but not required — surfaces underai-friendly/strictonlydeprecated- Using old API/feature — surfaces under every profilesecurity- Hardcoded secrets, unauthenticated webhooks — surfaces under every profileperformance- Potential performance issue — advisory,ai-friendly/strict
Example (best-practice — appears under ai-friendly / strict):
{
"type": "warning",
"nodeName": "Slack",
"message": "Slack API can have rate limits and transient failures"
}3. Suggestions (Optional)
Nice to have - Improvements that could enhance workflow
Types:
optimization- Could be more efficientalternative- Better way to achieve same result
The Validation Loop
Pattern from Telemetry
7,841 occurrences of this pattern:
1. Configure node
↓
2. validate_node (23 seconds thinking about errors)
↓
3. Read error messages carefully
↓
4. Fix errors
↓
5. validate_node again (58 seconds fixing)
↓
6. Repeat until valid (usually 2-3 iterations)Example
// Iteration 1
let config = {
resource: "channel",
operation: "create"
};
const result1 = validate_node({
nodeType: "nodes-base.slack",
config,
profile: "runtime"
});
// → Error: Missing "name"
// ⏱️ 23 seconds thinking...
// Iteration 2
config.name = "general";
const result2 = validate_node({
nodeType: "nodes-base.slack",
config,
profile: "runtime"
});
// → Error: Missing "text"
// ⏱️ 58 seconds fixing...
// Iteration 3
config.text = "Hello!";
const result3 = validate_node({
nodeType: "nodes-base.slack",
config,
profile: "runtime"
});
// → Valid! ✅This is normal! Don't be discouraged by multiple iterations.
Validation Profiles
The four profiles are cumulative (n8n-mcp ≥ 2.63.0): each surfaces everything the lower one does, plus more. The dividing line is best-practice advisories — minimal and runtime withhold them; ai-friendly and strict add them. Errors are the same across every profile except that minimal skips a few config-level checks (e.g. enum validation of an explicit operation). Security and deprecation warnings surface under every profile.
minimal
Use when: Quick structural checks while wiring a workflow together.
Surfaces: hard errors that would stop execution (missing required fields, empty code, broken connections). Skips enum checks and all advisories.
Fastest and most permissive.
runtime (RECOMMENDED default)
Use when: Ongoing validation as you build; the everyday profile.
Surfaces: errors (required fields, value types, allowed values, dependencies, broken references) plus security and deprecation warnings. No best-practice advisories.
Balanced — catches everything that breaks, stays quiet about style.
ai-friendly
Use when: You want the best-practice advice before deploying.
Surfaces: everything runtime does, plus best-practice advisories — per-node "without error handling" suggestions, "webhook should always send a response", rate-limit notes, outdated-typeVersion suggestions, cachedResultName and long-chain hints.
Note: ai-friendly is stricter than runtime, not looser. (Older docs described it as reducing false positives — that was true only while profile gating was broken; it is fixed now.)
strict
Use when: Hardening a production-critical workflow.
Surfaces: everything ai-friendly does, plus leftover-property checks ("property 'X' won't be used — not visible with current settings").
Maximum lint. With the false positives fixed at the source, its warnings are advice to weigh, not noise to fight.
Common Error Types
Five core error types, in rough order of frequency:
missing_required— a required field isn't provided. Useget_nodeto see required fields, then add it.invalid_value— value doesn't match allowed options (enums are case-sensitive). Check the error's allowed list orget_node.type_mismatch— wrong data type (string"100"vs number100). Convert to the expected type.invalid_expression— expression syntax error (missing{{}}, typos). See the n8n Expression Syntax skill.invalid_reference— referenced node doesn't exist (renamed, deleted, or misspelled). Fix the name orcleanStaleConnections.
A sixth class, patchNodeField errors (find-not-found, ambiguous match, invalid/unsafe regex), surfaces when a patchNodeField op fails during n8n_update_partial_workflow — it's strict by design and errors rather than silently continuing.
Every type above has worked examples (broken config → fix) plus the patchNodeField error cases and their fixes in ERROR_CATALOG.md.
Auto-Sanitization System
Automatically normalizes common operator structures on ANY workflow update — n8n_create_workflow, n8n_update_partial_workflow, or any save. Trust it; don't hand-fix these.
What it normalizes on save:
Binary operators (equals, notEquals, contains, notContains, greaterThan, lessThan, startsWith, endsWith) — removes a stray
singleValueproperty.Unary operators (isEmpty, isNotEmpty, true, false) — adds
singleValue: true.IF/Switch metadata — fills in
conditions.optionsfor IF v2.2+ and Switch v3.2+.
Validation no longer errors on these shapes (n8n-mcp ≥ 2.63.0). n8n derives unary-ness from the operator name and defaults the conditions.options sub-fields, so validate_node / validate_workflow accept a condition whether or not singleValue and the options metadata are present — the sanitizer just tidies the canonical form on save. (Older servers wrongly errored on the un-normalized shape; if you see that, upgrade.) What still is a real error: a v1-shaped conditions object on a v2 node, an empty filter with no conditions, and legacy v1 operator names (e.g. smaller) inside a v2 structure.
What the sanitizer CANNOT fix (handle manually): broken connections to non-existent nodes (use cleanStaleConnections), branch-count mismatches (add/remove connections or rules), and paradoxical corrupt states (may need manual DB intervention).
Before/after examples and the full cannot-fix detail are in ERROR_CATALOG.md (Auto-Sanitization sections).
False Positives
The validator overhaul (n8n-mcp ≥ 2.63.0) removed the classic false positives — template literals inside expressions, optional chaining, omitted-operation defaults, the Webhook → Respond-to-Webhook pattern, IF/Filter legacy shapes, and more no longer fire.
Known exceptions (n8n-mcp 2.85.0, reported upstream; re-check after upgrading):
ERROR "Incorrect error output configuration… appear to be error handlers but are in main[0]" on a fan-out where one target is a Respond to Webhook or Send Email node, or has error / fail / catch / exception in its name. Moving Respond to Webhook onto
main[1], as suggested, means the webhook only answers when the upstream node fails. Treat it as a false positive only when the message matches this text exactly and you've inspectedconnectionsand confirmed the named node sits on the success path by design. In that case keep the wiring, say in your reply that you're ignoring n8n-mcp#1111 and why, and don't runn8n_autofix_workflowwith the default fix types (excludeerror-output-config, or it may rewire the success path). Every othervalid: falseerror still gets fixed. (n8n-mcp#1111)Warning "Possible missing $ prefix" on
json/itemsinside a string, e.g.$jmespath($('X').all(), "[?json.country=='PL'].json.name"). Thejson.prefix is required there, so ignore the warning. (#1115)validate_nodeon alanguage: "pythonNative"Code node → "Code cannot be empty" (jsCode). The error is false; validate the workflow instead. (#1112)Python "Return value must be a list of dicts" for a single-dict return in all-items mode. n8n accepts it and emits one item. (#1113)
Blind spots (valid workflow, wrong result at runtime): $jmespath syntax/quoting mistakes inside expressions (#1114); any JS error inside {{ }}, which resolves to null while the execution stays green (see n8n-expression-syntax); native-Python mistakes such as legacy _input/_json, dot access, blocked imports and classes (#1113, see n8n-code-python). Validation plus a successful run still isn't proof: inspect the output values.
What remains are best-practice advisories (surfaced only under ai-friendly / strict) that flag a real trade-off but may be acceptable in your case. Not every advisory needs a fix — many are context-dependent. Common ones and when each is acceptable vs. worth fixing:
"...without error handling" — OK for dev/testing and non-critical notifications; fix for production handling important data. (Never a hard error — style doesn't block execution.)
"No retry logic" — OK for idempotent ops, APIs with their own retry, manual triggers; fix for flaky external services and production automation.
"...rate limits and transient failures" — OK for internal/low-volume/server-side-limited APIs; fix for public, high-volume APIs.
"Unbounded query" — OK for small known datasets, aggregations, dev/testing; fix for production queries on large tables.
Security and deprecation warnings, by contrast, surface under every profile and should be treated as real.
Full per-case guidance, the list of what the validator no longer flags, profile strategies, the "should I fix this?" decision framework, and how to document accepted advisories are in FALSE_POSITIVES.md.
Validation Result Structure
Complete Response
{
"valid": false,
"errors": [
{
"type": "missing_required",
"property": "channel",
"message": "Channel name is required",
"fix": "Provide a channel name (lowercase, no spaces)"
}
],
"warnings": [
{
"type": "best_practice",
"property": "errorHandling",
"message": "Slack API can have rate limits",
"suggestion": "Add onError: 'continueRegularOutput'"
}
],
"suggestions": [
{
"type": "optimization",
"message": "Consider using batch operations for multiple messages"
}
],
"summary": {
"hasErrors": true,
"errorCount": 1,
"warningCount": 1,
"suggestionCount": 1
}
}How to Read It
Check
validfirst —truemeans the config is valid;falsemeans there are errors to fix before deployment.Fix
errorsfirst — each carries aproperty,message, andfix. These must be resolved.Review
warnings— each has amessageandsuggestion; decide per-case whether to address it (see False Positives above).Consider
suggestions— optional improvements, not required.
Workflow Validation
validate_workflow (Structure)
Validates entire workflow, not just individual nodes
Checks:
Node configurations - Each node valid
Connections - No broken references
Expressions - Syntax and references valid
Flow - Logical workflow structure
Example:
validate_workflow({
workflow: {
nodes: [...],
connections: {...}
},
options: {
validateNodes: true,
validateConnections: true,
validateExpressions: true,
profile: "runtime"
}
})Common Workflow Errors
1. Broken Connections
{
"error": "Connection from 'Transform' to 'NonExistent' - target node not found"
}Fix: Remove stale connection or create missing node
2. Cycles (warning, not an error)
{
"warning": "Workflow contains a cycle: Node A → Node B → Node A"
}A cycle is a warning, not a hard error (n8n-mcp ≥ 2.63.0) — runtime-controlled loops (error-retry, data-driven pagination, a router feeding back) execute to completion and are legitimate. Fix only if the loop is unintentional: ensure the cycle has a real exit (a conditional node, an error output, or a bounded counter) so it can't spin forever.
3. Multiple Start Nodes
{
"warning": "Multiple trigger nodes found - only one will execute"
}Fix: Remove extra triggers or split into separate workflows
4. Disconnected Nodes
{
"warning": "Node 'Transform' is not connected to workflow flow"
}Fix: Connect node or remove if unused
Recovery Strategies
Strategy 1: Start Fresh
When: Configuration is severely broken
Steps:
Note required fields from
get_nodeCreate minimal valid configuration
Add features incrementally
Validate after each addition
Strategy 2: Binary Search
When: Workflow validates but executes incorrectly
Steps:
Remove half the nodes
Validate and test
If works: problem is in removed nodes
If fails: problem is in remaining nodes
Repeat until problem isolated
Strategy 3: Clean Stale Connections
When: "Node not found" errors
Steps:
n8n_update_partial_workflow({
id: "workflow-id",
operations: [{
type: "cleanStaleConnections"
}]
})Strategy 4: Use Auto-fix
When: Validation errors that can be automatically resolved
Steps:
// Preview fixes (default - doesn't apply)
n8n_autofix_workflow({
id: "workflow-id",
applyFixes: false,
confidenceThreshold: "medium" // high, medium, low
})
// Review fixes, then apply
n8n_autofix_workflow({
id: "workflow-id",
applyFixes: true
})Auto-Fix Capabilities
The n8n_autofix_workflow tool can fix these issue types:
expression-format - Missing
=prefix in expressions (e.g.,{{ $json.field }}→={{ $json.field }})typeversion-correction - Downgrades nodes with unsupported typeVersions
error-output-config - Removes conflicting onError settings
node-type-correction - Fixes unknown node types using similarity matching (90%+ confidence)
webhook-missing-path - Generates UUIDs for webhook nodes missing path configuration
typeversion-upgrade - Smart upgrades to latest node versions with auto-migration
version-migration - Guidance for complex breaking changes requiring manual steps
Confidence levels: high (90%+, safe to auto-apply), medium (70-89%, review recommended), low (<70%, manual review required)
// Preview all fixes
n8n_autofix_workflow({id: "workflow-id"})
// Only apply high-confidence fixes
n8n_autofix_workflow({
id: "workflow-id",
applyFixes: true,
confidenceThreshold: "high"
})
// Target specific fix types
n8n_autofix_workflow({
id: "workflow-id",
fixTypes: ["expression-format", "typeversion-upgrade"],
applyFixes: true
})Post-update guidance: For version upgrades, check the postUpdateGuidance field in the response for step-by-step migration instructions.
Best Practices
✅ Do
Validate after every significant change
Read error messages completely
Fix errors iteratively (one at a time)
Use
runtimeprofile for pre-deploymentCheck
validfield before assuming successTrust auto-sanitization for operator issues
Use
get_nodewhen unclear about requirementsDocument false positives you accept
❌ Don't
Skip validation before activation
Try to fix all errors at once
Ignore error messages
Use
strictprofile during development (too noisy)Assume validation passed (always check result)
Manually fix auto-sanitization issues
Deploy with unresolved errors
Ignore all warnings (some are important!)
Running the workflow after it validates
validate_workflow checks structure, parameters and expressions — it never runs anything. A workflow that validates cleanly can still fail on real data, so run it once before calling it done.
With a webhook, form or chat trigger: n8n_test_workflow({workflowId}) — the default method: "auto" detects the trigger and fires it over HTTP (the workflow must be active).
Without such a trigger (Manual Trigger, Schedule, sub-workflow) there is no HTTP entry point. Use the pin-data path, which runs through n8n's own MCP server (N8N_MCP_ACCESS_TOKEN, n8n 2.34+):
n8n_test_workflow({workflowId, method: "prepare"})— lists the nodes that need pinned data.Build one sample item per listed node, keyed by node name, each item wrapped in
{json: {...}}:{"When clicking 'Test workflow'": [{"json": {"orderId": "1234", "email": "[email protected]"}}]}A flat object instead of an array of
{json}items is the usual mistake here.n8n_test_workflow({workflowId, method: "pinned", pinData})— runs it with that data and waits for the result.
For a quick manual run without pinned data, method: "direct" starts a manual execution and returns as soon as it has started; poll n8n_executions({action: "get", id: executionId, mode: "error"}) for the outcome. Nothing is pinned on a direct run, so every node executes and any external call it makes is real — and even pinned only pins trigger, credentialed and HTTP Request nodes. executionMode: "production" changes the execution context, not whether there are side effects; leave it at the default unless the user asked for a production run.
method: "auto" never runs a workflow through n8n's MCP server. On a workflow with no external trigger it reports that fact and names prepare/pinned/direct; the routed methods only run when you ask for them by name.
Consent before the first routed run. n8n refuses these calls for a workflow whose "Available in MCP" setting is off, which comes back as WORKFLOW_NOT_EXPOSED. Re-running with exposeToMcp: true turns that setting on and retries once. It is a visible, persistent setting on the workflow (and enabling it is a workflow update, so a concurrent UI edit can be overwritten) — ask the user before passing it. The consent flow only ever enables the setting; nothing disables it implicitly. Turning it off again is a deliberate act: n8n_update_partial_workflow({id: workflowId, operations: [{type: "updateSettings", settings: {availableInMCP: false}}]}), or the toggle in the n8n UI.
Reading the result: a run that started and then failed comes back as EXECUTION_FAILED with the executionId — inspect it with n8n_executions({action: "get", id, mode: "error"}) and fix from the node that threw, then validate and run again.
Reviewing an existing workflow
Validating as you build (the loop above) is for catching schema and shape errors in your own in-progress work. Reviewing an existing workflow — yours or one you've been handed — is a different job: the workflow already passes validate_workflow clean, and you're hunting for the issues validation doesn't see (silent connection bugs, injection-prone queries, dropped-item Switches, Set/Code antipatterns, missing error paths). For that, pull the workflow with n8n_get_workflow and walk REVIEW_CHECKLIST.md — a severity-tiered audit (MUST FIX / SHOULD FIX / NICE TO HAVE) where every item points to the canonical skill for the fix. Run n8n_audit_instance alongside it to surface hardcoded secrets and unauthenticated webhooks across the whole instance.
Detailed Guides
For comprehensive error catalogs, false positives, and workflow review:
ERROR_CATALOG.md - Complete list of error types with examples
FALSE_POSITIVES.md - When warnings are acceptable
REVIEW_CHECKLIST.md - Severity-tiered audit for reviewing an existing workflow
Summary
Key Points:
Validation is iterative (avg 2-3 cycles, 23s + 58s)
Errors must be fixed, warnings are optional
Auto-sanitization normalizes operator structures on save; validation no longer errors on the raw shape
Use runtime profile by default; step up to
ai-friendly/strictfor best-practice advisoriesClassic false positives are fixed (≥ 2.63.0) — remaining warnings are advisories or security/deprecation notices, not validator mistakes
Read error messages - they contain fix guidance
Validation Process:
Validate → Read errors → Fix → Validate again
Repeat until valid (usually 2-3 iterations)
Review warnings and decide if acceptable
Deploy with confidence
Related Skills & Tools:
n8n MCP Tools Expert - Use validation tools correctly
n8n Expression Syntax - Fix expression errors
n8n Node Configuration - Understand required fields
n8n_audit_instance- Proactive security validation (hardcoded secrets, unauthenticated webhooks, missing error handling, data retention)
Files
- ATTRIBUTION.mdAdded by AutoGineer899 B
- ERROR_CATALOG.md23.2 KiB
- FALSE_POSITIVES.md21.0 KiB
- LICENSELicence file added by AutoGineer1.1 KiB
- README.md8.3 KiB
- REVIEW_CHECKLIST.md16.2 KiB
- SKILL.md22.4 KiB
REVIEW_CHECKLIST.md
Workflow Review Checklist
A severity-tiered audit for reviewing an existing n8n workflow — yours or anyone's. This is different from the validate-as-you-build loop in the main skill: that loop catches schema and shape errors with validate_node / validate_workflow; this checklist catches the silent issues those tools pass clean — antipatterns, security holes, broken-but-valid connections, and missing error paths.
How to use
Pull the workflow first, then walk the list top to bottom. For each item, inspect the actual JSON and decide if it applies. Report findings grouped by severity, each pointing at the canonical skill for the why and the fix.
You're reviewing JSON, not source. n8n_get_workflow returns nodes (with parameters, credentials, type strings like nodes-base.httpRequest) and a connections graph. Phrase findings in JSON terms: "node Route order has no parameters.options.fallbackOutput, so unmatched items drop."
Bare NODE_FAMILY_GOTCHAS.md references in the lists below all point to n8n-node-configuration/NODE_FAMILY_GOTCHAS.md.
| Severity | Meaning | Action |
|---|---|---|
| MUST FIX | Ship-blocker: security hole, broken connection, production-breaking bug. | If the workflow is active, stop it; fix before re-enabling. |
| SHOULD FIX | Real issue: antipattern, missing error handling on a production path, broken contract. | Fix in the next change. |
| NICE TO HAVE | Polish: naming, descriptions, readability. | Clean up opportunistically. |
A review agent should not auto-fix MUST FIX items without user confirmation — security and connection changes have blast radius. Surface the finding, propose the fix, wait for approval.
Contents
Cross-cutting first
MUST FIX
SHOULD FIX
NICE TO HAVE
Reporting findings
Cross-cutting first
[ ] Pull the workflow.
n8n_get_workflow({ id })so every check runs on real JSON, not assumptions. Usestructuremode for a fast graph read,fullwhen you need parameters, andfiltered+nodeNamesto read a single heavy node (e.g. a long Code node) on a large workflow that would otherwise truncate client-side when fetched whole.[ ] Logic smell test. Trace the happy path once, top to bottom. Does the structure match the workflow's stated purpose? Anything dead, contradictory, or out of place (a write node in a "read-only" flow, a fan-out branch wired nowhere, an HTTP call to an unrelated domain)? → n8n-workflow-patterns
[ ] Note the trigger type and whether it's active. Severity shifts with both: a webhook/API or unattended schedule needs error paths a manual run doesn't, and an active workflow with broken connections is higher severity.
MUST FIX
Credentials and secrets
[ ] Tokens / API keys / passwords in node text fields (
Bearer xxx,sk-...typed into an HTTP header value, a query param, or any parameter). The credential system is the only correct home. Usen8n_manage_credentialsto inspect/migrate. → n8n-mcp-tools-expert (credential management)[ ] Secrets stored in Set node values for later
{{ $json.token }}referencing. The secret is in the workflow JSON regardless of how it's read. → n8n-mcp-tools-expert[ ] Hardcoded credentials inside Code nodes. Same leak surface as text fields. → n8n-code-javascript / n8n-code-python (anti-patterns)
[ ] Placeholder credential IDs (
"id": "REPLACE_ME") left in thecredentialsblock. n8n renders a permanently disabled selector for unknown IDs. Omit the block when the real ID is unknown. → n8n-node-configuration
Run
n8n_audit_instanceto surface hardcoded secrets and unauthenticated webhooks across the instance automatically. → n8n-validation-expert
SQL / query injection
[ ] User input interpolated into a query string. Any DB node with
{{ ... }}insideparameters.query— n8n substitutes it into the SQL before the driver binds parameters, so it's an injection vector. Use$1, $2placeholders +parameters.options.queryReplacement(Postgres/MySQL); object filters for Mongo. → n8n-node-configuration → NODE_FAMILY_GOTCHAS.md (Database)
Connection bugs (valid but broken)
[ ] Merge with 3+ sources but
numberInputsstill 2 (or set under the wrong namenumberOfInputs, which is ignored). Third source silently drops. → n8n-node-configuration → NODE_FAMILY_GOTCHAS.md (Merge)[ ] Merge index off-by-one.
parameters.useDataOfInputis 1-indexed; the wire sits atconnections.<source>.main[N-1]. Mismatch passes through the wrong source silently. Verify withn8n_get_workflow. → n8n-node-configuration → NODE_FAMILY_GOTCHAS.md (Merge)[ ] Error output enabled but unwired, or wired but not enabled. If
parameters.onErroriscontinueErrorOutputbut the node's error output is empty, failed items are silently dropped; if a node feeds an error branch butonErrorisn't set, the branch is unreachable and a failure halts the workflow.validate_workflownow surfaces both as warnings (n8n-mcp ≥ 2.63.0), but neither flipsvalid:false, so this stays a review item. Locate the error output by node type: it is the lastmain[]slot after the node's natural outputs —main[1]on a single-output node like HTTP Request, butmain[2]on an IF (whosemain[1]is the normal false branch) and similarly on Switch/Split In Batches. Don't mistake a wired second branch on a multi-output node for an unwired error output. → n8n-validation-expert
Switch
[ ] No fallback output. Without
parameters.options.fallbackOutput: "extra", unmatched items drop silently. → n8n-node-configuration → NODE_FAMILY_GOTCHAS.md (Switch)
Webhook API workflows
[ ] Webhook performing a sensitive action with
parameters.authentication: "none". "Sensitive" = mutates state, sends external messages, hits production data, triggers paid actions. Anyone with the URL can fire it. SetauthenticationtobasicAuth/headerAuthwith a matching credential. → n8n-workflow-patterns (webhook), n8n-mcp-tools-expert (credentials)[ ] Error branch returns HTTP 200.
options.responseCodedefaults to 200 on every Respond node, including error paths — and a top-levelresponseCodeis ignored, so check where it's set. The caller sees success while the body says failure. → n8n-node-configuration → NODE_FAMILY_GOTCHAS.md (Webhook)
SHOULD FIX
Set-node antipattern
[ ] Set node that only re-maps fields for the next node. The most common antipattern. Delete it and inline the expressions at the consumer. Keep Edit Fields when it creates something: a constant item, an error or return item (incl. a sub-workflow's final Return node), a payload object, or a value several nodes read. → n8n-expression-syntax ("The Set-node antipattern and branch convergence")
[ ] Set node building an email / Slack body. Build the body inline in the comms node's body field. → n8n-expression-syntax
[ ] Set node mapping fields right before a write node. Map directly in the write node's per-field expression slots. → n8n-node-configuration
[ ] Multiple consecutive Set nodes each defining one field. Collapse into one, or eliminate. → n8n-expression-syntax
Code-node antipattern
[ ] Code node doing a native-node job. Filtering (Filter), routing (IF / Switch), totals (Summarize), top-N (Sort + Limit), dedupe (Remove Duplicates), joins (Merge), diffs (Compare Datasets), arrays (Split Out / Aggregate), dates (Date & Time), API paging (HTTP Request pagination), or single-item shaping (short expressions in the consumer). Check the job-to-node table in using-n8n-mcp-skills; configs in n8n-node-configuration → NATIVE_NODES.md.
[ ] Code or HTTP Request node without a
Why Code:/Why HTTP:note. A Code node that stays must be on the closed list (loops or recursion no node expresses, state across runs, parsing no node handles, a library, heavy all-items work, one short node replacing 4+ glue nodes) and say so innotes. → n8n-code-javascript[ ] Function body inside
{{ }}in a non-Code node ((() => { … })()). Several statements in an expression are code: a native node plus short expressions, or a Code node with aWhy Code:note. → n8n-expression-syntax (the transform gatekeeper)[ ] Code node using
crypto.createHash/crypto.createHmac. Use the native Crypto node (nodes-base.crypto). Recurring slip. → n8n-code-javascript[ ] Code node parsing XML / SOAP / RSS. Use the native XML node (
nodes-base.xml) + Edit Fields for extraction. → n8n-code-javascript[ ] HMAC verified over
JSON.stringify($json.body). Valid signatures fail. Webhookoptions.rawBody: true+ Crypto (typeVersion 2,binaryData: true, secret from acryptocredential). → n8n-node-configuration → NATIVE_NODES.md[ ] Python Code node where JS would do. Use Python only when the user asked for it: native Python has no n8n helpers and, by default, no imports (not even
json/re/datetime). Also flag legacy_input/_json/_node/_nowusage oritem.json.xdot access. Those fail on n8n 2.x. → n8n-code-python
Expression discipline
[ ]
$json.xdeep in a branchy / multi-step workflow. Switch to$('Source Node').item.json.xfor refactor stability; the$jsonform breaks silently when an intermediate is inserted or context is cleared. → n8n-expression-syntax (non-negotiable)[ ] Branches converge with
$jsonreferences downstream. Whichever branch fired last wins, non-deterministically. Insert a NoOp (Combine Inputs) at the merge and reference it by name; use a Set to normalize if the branch shapes differ. → n8n-expression-syntax[ ] Date & Time node without
options.includeInputFields: truewhere downstream nodes still need the item's other fields — they're dropped. (The node itself is fine; so is an inline Luxon one-liner.) → n8n-node-configuration → NATIVE_NODES.md[ ]
$env.Xin any expression. Doesn't work, throws at runtime. Use$vars.X(paid plans), a Data Table, or a credential for secrets. → n8n-expression-syntax[ ]
.all().map()/filter()/reduce()aggregation withoutexecuteOnce: trueon the node. It re-runs the full aggregation per input item — wasted work, and N identical outputs where one was expected. (LeaveexecuteOnceoff when.all()is a per-item lookup keyed by the current item.) → n8n-expression-syntax
Slack / comms
[ ] Block Kit passed as a bare array. Posts as plain text, silently. Wrap as
={{ { "blocks": ... } }}. → n8n-node-configuration → NODE_FAMILY_GOTCHAS.md (Slack)[ ] Thread reply posting as a top-level message —
thread_tsnot set or in the wrong place. → n8n-node-configuration → NODE_FAMILY_GOTCHAS.md (Slack)[ ] Operation set from the UI display name (
"send") rather than the internal value ("post"). Confirm withget_node. → n8n-node-configuration
Database
[ ]
select/ query with no-match path feeding an IF, butalwaysOutputDatanot set. No match = zero items = the IF never fires. → n8n-node-configuration → NODE_FAMILY_GOTCHAS.md (Database)[ ] Multi-step writes needing atomicity split across nodes. No cross-node transaction exists; collapse into one
executeQuerywithoptions.queryBatching: "transaction". → n8n-node-configuration → NODE_FAMILY_GOTCHAS.md (Database)[ ] Write node (INSERT/UPDATE/DELETE) followed by a node expecting its output, without
alwaysOutputData. Writes often return 0 items and stall the chain. → n8n-node-configuration
Webhook / Respond to Webhook
[ ]
responseModeleft atonReceivedfor a request/response API. Caller never sees the computed result; useresponseNode. → n8n-node-configuration → NODE_FAMILY_GOTCHAS.md (Webhook)[ ] Generic 500 for every failure. Map status codes: 400 validation, 401/403 auth, 409 conflict, 429 rate limit. → n8n-node-configuration
[ ]
respondWith: "json"body built withJSON.stringify(...). Double-encodes. Pass the object literal in expression mode. → n8n-node-configuration → NODE_FAMILY_GOTCHAS.md (Webhook)[ ] Fallible nodes (HTTP/DB/API) on a webhook path with no error branch. A failure halts the workflow and the caller gets n8n's generic error. Wire
onError: "continueErrorOutput"+ a 5xx Respond, and validate the wiring. → n8n-error-handling, n8n-workflow-patterns (webhook)
HTTP Request
[ ] Auth header typed into
headerParametersinstead of a credential. Use Bearer Auth / Header Auth credentials. → n8n-node-configuration, n8n-mcp-tools-expert[ ] Headers set via both
headerParametersand a credential's header auth. They conflict. → n8n-node-configuration[ ] Network-calling node (HTTP/comms/DB/AI) without
retryOnFail. Transient 429s and blips surface as hard failures. (Transient-failure handling folds into node config for now.) → n8n-node-configuration
Schedule trigger
[ ] Business-critical schedule with no explicit workflow timezone. DST and instance moves shift timing. → n8n-node-configuration → NODE_FAMILY_GOTCHAS.md (Schedule)
[ ] Schedule-triggered workflow not idempotent. Restarts can miss runs and re-runs can double-fire. → n8n-node-configuration → NODE_FAMILY_GOTCHAS.md (Schedule)
Structure and patterns
[ ] Workflow built without a recognizable pattern where one fits (webhook, HTTP API, database, AI, scheduled, batch). Reshape to the proven pattern. → n8n-workflow-patterns
[ ] Fan-out branches assumed to run in parallel. n8n runs them sequentially. Real concurrency needs sub-workflow dispatch. (Sub-workflow guidance is pending a dedicated skill; note the limitation for now.) → n8n-workflow-patterns
[ ] Large-item-count flow doing per-item work where batching/aggregation would cut overhead. → n8n-workflow-patterns
AI Agent / Code Tool (when present)
[ ] Custom Code Tool returning a non-string (
[{json:{...}}]) or using$fromAI/$input/$helpers— none exist in the Code Tool sandbox; the return must be a string. → n8n-code-tool[ ] Tool with a generic/empty name or description. The model can't tell when to call it; descriptions are part of the prompt. Use verb-first specific names. (Deeper agent guidance is pending a dedicated skill.) → n8n-code-tool
NICE TO HAVE
Naming
[ ] Generic node names (
HTTP Request1,Set2,Postgres1). A runtime failure onFetch order detailslocalizes the break instantly;HTTP Request3tells the operator nothing. Rename to describe what the node does in this workflow. → n8n-workflow-patterns[ ] Workflow name not verb-first (
Send weekly customer report, notCustomer report sender). Sentence case, no emojis, no trailing version numbers. → n8n-workflow-patterns
Readability
[ ] Workflow
descriptionempty or one line. Two sentences: what it does and why it exists (the "why" is the part that otherwise gets lost). → n8n-workflow-patterns[ ] Code node with no
Why Code:note naming the native node considered and the closed-list reason. → n8n-code-javascript[ ] Multi-line expression that isn't indented or commented. Most n8n users aren't coders — format it like real code. → n8n-expression-syntax
Reporting findings
Group by severity, then by domain. For each finding give the node(s) affected, a one-sentence description, and the canonical skill for the fix.
MUST FIX
Security
- Node `Send webhook`: bearer token typed into headerParameters value. -> n8n-mcp-tools-expert (credentials)
- Node `Lookup user`: {{ $json.email }} interpolated into parameters.query. -> NODE_FAMILY_GOTCHAS.md (Database)
Connections
- Node `Merge customer + Stripe`: 3 sources wired but parameters.numberInputs = 2; third drops. -> NODE_FAMILY_GOTCHAS.md (Merge)
SHOULD FIX
Set-node antipattern
- Node `Set customer_id`: feeds one consumer; inline at `Lookup customer`. -> n8n-expression-syntax
...Requirements and compatibility
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Needs an MCP server, Needs Python, Needs Node.js
Security
No issues found by our static scan· No issues found
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Created by
- Romuald Czlonkowski
- Publisher
- Romuald Czlonkowski (Community)
- Source
- czlonkowski/n8n-skills · skills/n8n-validation-expert · commit e037563
- Licence
- MIT License (redistribution allowed)
- LICENSE (added by AutoGineer from LICENSE)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
AutoGineer is not affiliated with or endorsed by Romuald Czlonkowski or Romuald Czlonkowski.
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download n8n-validation-expert.zip