1. Habit
  2. Skills
  3. n8n Credentials and Security skill
n8n-io · 2K installs

n8n Credentials and Security skill
Runs by itself, weekly secret scan.

No secrets hardcoded in workflows.

Install the n8n Credentials and Security skill and make it a habit: follow https://gethabit.dev/skills/n8n-io/n8n-credentials-and-security-official.md

  1. 1Copy
  2. 2Paste into Claude Code, Codex or Cursor
  3. 3It runs by itself

2K installs549 starsApache-2.0 licenceSource on GitHub ↗

n8n Credentials and Security

by n8n-io · 2K installs

The skill

The n8n credentials and security skill helps builders keep API keys, tokens and OAuth secrets in the n8n credential system, bound by ID, never in text fields or code.

Only when you ask.

The habit

No secrets hardcoded in workflows.

↻ Runs by itselfweekly secret scan

How the habit works.
You don't have to.

Three questionsWhen does it start? How does it check its work? What does it remember?

01

It starts by itself

weekly secret scan. Runs in Claude Code routine.

  • ↻ weekly secret scan
  • 0 8 * * 1

02

It checks its work

no plain-text secrets left. If a check fails, it tells you.

  • ✓no Authorization header value holds a literal token
  • ✓no Set node or $vars entry holds a secret
  • ✓every auth node is bound to a credential by ID

03

It remembers

secret audit log. The next run reads it first: nodes rebound and credentials you still must create.

loops/n8n-secret-audit-loop/run-log.md

One run, step by step.
Then it stops.

Stop ruleStops after 10 workflows per run.

  1. 01

    Scan workflows

    Find secrets in header fields, Set nodes, $vars or SDK code.

  2. 02

    List credentials

    Call list_credentials with the type before binding any node.

  3. 03

    Bind by ID

    Bind one match with setNodeCredential; ask you when several match.

  4. 04

    Name missing types

    Tell you the exact credential type to create in the UI.

  5. 05

    Flag leaks

    Mark any secret seen in plain text as leaked and ask you to rotate it.

What it may do.
Nothing more.

Safe by defaultIt writes only in its own folder and asks you before anything goes out.

Is it for you?
Use it when it fits.

Quick checkRead both lists. If the left one sounds like you, the n8n Credentials and Security skill helps.

Use it when

  • ✓ You add auth to an n8n node
  • ✓ Someone pasted a token into chat
  • ✓ No native node exists for a service

Skip it when

  • – You do not use n8n
  • – You need to create credentials programmatically

Questions

n8n Credentials and Security skill, answered.

Can the agent create credentials?

No. Credential creation is the user's job in the n8n UI.

Is $env a safe place for a secret?

No. It throws at runtime in custom auth; use a credential type.

How do I install the n8n Credentials and Security skill?

Copy the prompt at the top into your agent. It installs the skill from n8n-io/skills and sets up the habit. Or run npx skills add n8n-io/skills --skill n8n-credentials-and-security-official.

Is the n8n Credentials and Security skill free?

Yes. It is published under Apache-2.0. Habit is free too.

n8n Credentials and Security. Now as a habit.

Install the n8n Credentials and Security skill and make it a habit: follow https://gethabit.dev/skills/n8n-io/n8n-credentials-and-security-official.md

  • Free
  • No account
  • Undo in one line

All n8n-io skills →More ops skills →

Works in

  • Claude Code
  • Codex
  • Cursor
  • ChatGPT
  • Claude app

Made by n8n-io, published under Apache-2.0. Habit links to the original and never changes it. Is this your skill?

Copying didn't work here. Select the line and copy it by hand.