Description

Detects when an AI agent in the published version of an n8n workflow has a tool that draws on a vector store, the Vector Store Question Answer Tool or a vector store node in its Retrieve Documents (As Tool for AI Agent) mode. What that tool returns comes from the documents in the store and enters the agent's context, so whoever can add or change those documents, such as through a workflow that stores the files, emails or web pages it receives, can plant instructions or false facts meant to change what the agent answers and which of its other tools it calls.

Detection Strategy

• Lists every workflow the API key's user can see through the n8n public API, all of them for an owner or admin key, and reads only the version of each one that is published, skipping disabled nodes

• Keeps the nodes that let a model call tools, the AI Agent node and tool and the OpenAI, Anthropic, Google Gemini, Ollama and other model nodes with a Tools input, and the tools connected to that input

• Counts the Vector Store Question Answer Tool and any node whose operation mode is Retrieve Documents (As Tool for AI Agent), connected to the agent directly or through a human review tool, which asks a person to approve each call but not what the call returns

• Reports a vulnerability when an agent has one of those tools, and records in the evidence each such agent with the name and type of those tools, or of the human review tool they pass through; a workflow whose listing omits the published version field, or whose published version has no node list or no connections, is recorded as unreadable rather than reported as clean