optimization track-skill-usage.mjs

[saiganesh47]

This script reads JSON input from stdin and sends anonymized telemetry data to the specified telemetry host, tracking skill usage in n8n.

Summary

Related Linear tickets, Github issues, and Community forum posts

Review / Merge checklist

• I have seen this code, I have run this code, and I take responsibility for this code.
• PR title and summary are descriptive. (conventions)
• Docs updated or follow-up ticket created.
• Tests included.
• PR Labeled with Backport to Beta, Backport to Stable, or Backport to v1 (if the PR is an urgent fix that needs to be backported)

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[aikido-pr-checks]

Exposed secret in .claude/plugins/n8n/scripts/optimization track-skill-usage.mjs - high severity
Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.
More Info}

[cubic-dev-ai]

2 issues found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".claude/plugins/n8n/scripts/optimization track-skill-usage.mjs">

<violation number="1" location=".claude/plugins/n8n/scripts/optimization track-skill-usage.mjs:14">
P1: Custom agent: **Security Review**

Security Review (Credential & Secret Handling): do not hardcode API/write keys in source. Load the telemetry write key from runtime configuration instead.</violation>

<violation number="2" location=".claude/plugins/n8n/scripts/optimization track-skill-usage.mjs:101">
P2: Forced `process.exit(0)` in `finally` can terminate the process before fire-and-forget telemetry `fetch` completes.</violation>
</file>

Architecture diagram

sequenceDiagram
    participant P as n8n Claude Plugin
    participant S as track-skill-usage.mjs
    participant OS as Node.js / OS
    participant T as telemetry.n8n.io

    Note over P,T: NEW: Anonymized Telemetry Flow

    P->>S: Pipe JSON input via stdin
    S->>S: readStdin()
    S->>S: NEW: Validate tool_input.skill (n8n: prefix)
    
    alt Skill is valid
        S->>OS: NEW: Get user, host, and OS info
        OS-->>S: Raw system identity
        S->>S: NEW: SHA256 Hash identity (anonymousId)
        
        S->>T: NEW: POST /v1/track
        Note right of S: Headers: Authorization: Basic [WRITE_KEY]<br/>Body: { userId, event, skill }
        
        alt Network Success (within 1500ms)
            T-->>S: 200 OK
        else Timeout / Error
            S->>S: Abort controller triggers
            Note right of S: Silently ignore failures
        end
    else Invalid or Missing Skill
        S->>S: Early exit
    end
    
    S-->>P: Process exit(0)

Loading

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

[cubic-dev-ai]

P1: Custom agent: Security Review

Security Review (Credential & Secret Handling): do not hardcode API/write keys in source. Load the telemetry write key from runtime configuration instead.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .claude/plugins/n8n/scripts/optimization track-skill-usage.mjs, line 14:

<comment>Security Review (Credential & Secret Handling): do not hardcode API/write keys in source. Load the telemetry write key from runtime configuration instead.</comment>

<file context>
@@ -0,0 +1,103 @@
+
+// ---- Constants ----
+const TELEMETRY_HOST = "https://telemetry.n8n.io";
+const TELEMETRY_WRITE_KEY = "1zPn7YoGC3ZXE9zLeTKLuQCB4F6";
+const TIMEOUT_MS = 1500;
+
</file context>

[cubic-dev-ai]

P2: Forced process.exit(0) in finally can terminate the process before fire-and-forget telemetry fetch completes.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .claude/plugins/n8n/scripts/optimization track-skill-usage.mjs, line 101:

<comment>Forced `process.exit(0)` in `finally` can terminate the process before fire-and-forget telemetry `fetch` completes.</comment>

<file context>
@@ -0,0 +1,103 @@
+  } catch {
+    // Absolute fail-safe
+  } finally {
+    process.exit(0);
+  }
+})();
</file context>