CSINT n8n Workflow Change Receipt

Change A: Three threat intel tools are added to the agent

A human-readable evidence record for one workflow change. This is not a security certificate.

Delivery status, CLIENT-READY

Review subject

Review ID

wcr-fb5ed970c1fb-21155a81

Generated

2026-09-30T12:00:00.000Z

Baseline

Scanner Alert Triage
21155a81aa9e0dd4

Candidate

Scanner Alert Triage
fb5ed970c1fb031f

Customer or project

Public MIT template scanner-inc/agents, not a client

Reviewer

Ahmet Göker

Measured release view

What changed

Staging evidence

Retest evidence

Human validation register

1. TG-100-01, likely
   Ahmet Göker, 2026-09-30T13:00:00.000Z
   The path from Webhook through Alert Triage Agent to Send a message is real: the whole alert JSON goes into the prompt, and alert fields can hold text an attacker controls, such as a user or resource name. The webhook uses header auth and the end step posts to one fixed Slack channel, so the worst case is a wrong or misleading triage note. I would rate it medium for this template, not critical.
2. AA-003-02, confirmed
   Ahmet Göker, 2026-09-30T13:00:00.000Z
   Confirmed. The prompt is built with JSON.stringify of the whole request item, with no step that limits size or strips free text first. For a triage agent this is by design, which is why the tools it can call should stay read-only.
3. AA-004-03, confirmed
   Ahmet Göker, 2026-09-30T13:00:00.000Z
   Confirmed and by design: the model output is posted to Slack with no approval step. Posting the triage note is the purpose of the workflow. Approval is not needed here, but it is needed before any step that writes somewhere else.
4. AA-006-04, needs-environment-evidence
   Ahmet Göker, 2026-09-30T13:00:00.000Z
   No rate or cost limit is visible in the export. The alerts come from the detection platform behind header auth, so a limit may exist on the sending side; the export cannot show it. Ask the team where the alert rate is capped.
5. AA-005-05, confirmed
   Ahmet Göker, 2026-09-30T13:00:00.000Z
   Confirmed. The Slack text is the model output with only a cut at the first siren emoji. No schema check runs on it.
6. AA-008-06, confirmed
   Ahmet Göker, 2026-09-30T13:00:00.000Z
   Confirmed, introduced by this change. ThreatFox IOC Lookup, OTX Pulse Search and Feodo Tracker set no timeout and no retry. A slow lookup API holds the agent run. Fix: about 10 to 15 seconds and one retry on each.
7. AA-010-07, confirmed
   Ahmet Göker, 2026-09-30T13:00:00.000Z
   Confirmed, low. No error workflow is set, so a failed triage run goes unnoticed unless someone looks at the execution list.

Open findings from this change

1. MEDIUM AA-008
   Outbound requests do not show an explicit timeout or retry policy
   Set short timeouts and bounded retries with backoff. Make write actions idempotent so a retry cannot publish or charge twice.

Already present before this change

These findings match the baseline as well. They stay listed so nothing is hidden, but they do not decide this change on their own.

1. CRITICAL TG-100
   A prompt-injection source can steer a privileged action through the AI agent
   Break the chain: validate and constrain the input before the model, and require an explicit human approval step before the privileged action. Treat all trigger content as data, never as instructions.
2. HIGH AA-003
   Untrusted input can reach a model without a visible validation boundary
   Add a deterministic validation step before the model. Enforce size, type and allowlist rules, separate instructions from data, and test direct and indirect prompt injection cases.
3. HIGH AA-004
   A model can reach an external write action without an approval step
   Require explicit human approval for messages, writes, deletions, purchases, account changes and other high-impact actions. Use least-privilege credentials for the final action.
4. HIGH AA-006
   No rate or cost boundary was detected before model usage
   Add per-user and per-origin limits, a maximum input size, a model-call budget, timeouts, and a bounded retry policy.
5. MEDIUM AA-005
   No structured model-output validation was detected
   Validate model output against a strict schema before it is parsed, stored or passed to another tool. Reject unknown fields and unsafe values.
6. LOW AA-010
   No workflow-level failure route was detected
   Add a failure route that records the error, alerts the operator and prevents partial actions from being treated as success.

n8n instance audit evidence

Production Evidence Register

No production environment check has been recorded.

Customer acceptance record

Coverage still needed

• Production credential permissions and external-service authorization
• n8n instance security audit, installed versions, RBAC and hardening settings
• Identity of the workflow actually published to production
• AI output quality, tool-choice accuracy and model behaviour across a representative test set

Evidence boundaries

• This receipt compares exported JSON and a supplied staging record. It does not inspect production credential scope or external service authorization.
• Runtime evidence is accepted only when its canonical workflow fingerprint matches the candidate in this receipt.
• Local runtime receipts are reproducible evidence records, not cryptographically signed third-party attestations.
• A passing receipt records evidence for the tested policy and contract. It is not a penetration test, compliance certificate or security guarantee.
• Node names, node types, public domains and credential types can appear in the receipt. Prompt text, parameter values and credential values are omitted.
• Automatic findings remain review signals until a person records a manual review status. A score or clean static result is not a vulnerability verdict.
• Instance configuration, published-workflow identity, installed package versions and production permissions require separate environment evidence.

CSINT ReleaseGuard 1.3.0. This document records evidence for one reviewed change; it is not a general security guarantee.