kipn.ai
Shared workflow report

Generate best AI prompt using multi-model evaluation and save to Supabase

Analyzed

Executive Summary
n8n
Production RiskHigh

Fragile expression — likely to fail when production data shape differs from test data — These expressions work reliably against test data where all fields are present. In production, fields may be absent, null, or differently typed — causing a runtime error or silent null propagation at the point of the expression.

Cost ExposureHigh

AI agent has no iteration limit — In production, agents can enter loops — repeatedly calling a tool that returns ambiguous results. Without an iteration cap, a single execution can generate hundreds of tool calls, causing unpredictable cost spikes and potentially triggering rate limits on connected APIs.

Observability Gap

Side-effect node has no audit trail — If this action is disputed, replayed, or causes a data inconsistency, there is no structured record of what was sent, when, and with what data. Debugging requires cross-referencing n8n execution history with the external system's own logs.

56/ 100
Overall
Risk: HighCost: High
Reliability
0
Security
85
Cost Risk
68
Observability
92
AI Governance
100
Naming
97
Complexity
100
Nodes
20
Edges
15
External calls
9
LLM nodes
8
AI via HTTP
0
Loops
0
Error handlers
0
Unreachable
0
Max depth
7
Workflow Graph
Graph
20 nodes · 15 edges
100%
click a node to highlight its upstream & downstream paths
Controls Matrix
Present Partial Missing
CheckDescriptionStatus
Failure Alerting

Failures silent — only visible in execution log

Missing
Retry on Failure

Transient failures cause permanent stops

Present
Request Timeouts

Slow providers can block execution indefinitely

Missing
Duplicate Prevention

Retry on write events creates duplicate records

Missing
Empty Response Handling

Zero-result lookups break downstream logic

Present
AI Output Limits

Output cost and parsing risk unbounded

Present
AI Output Format

Free-form output will break downstream parsers

4 of 8 AI nodes lack structured output

Partial
Activity Logging

Side effects unlogged

Missing
Write Deduplication

Webhook replays may create duplicate records

Missing

Run this analysis on your own workflows

Break Points
2Fragile expressionRisk HighConfidence 85%1 node affected
Affected Nodes:
  • Create a row
What happens:

These expressions work reliably against test data where all fields are present. In production, fields may be absent, null, or differently typed — causing a runtime error or silent null propagation at the point of the expression.

Recommended Fix:
  • In `fieldsUi.fieldValues[0].fieldValue`, change {{ $('Webhook').item.json.body.goal }} to {{ $('Webhook')?.item?.json?.body?.goal }}.
  • In `fieldsUi.fieldValues[1].fieldValue`, change {{ $json.output }} to {{ $json?.output }}.

3AI blocks webhook responseRisk HighConfidence 85%4 nodes affected
Affected Nodes:
  • Webhook
  • Creative Prompt Agent
  • Marketing Prompt Agent
What happens:

Webhook senders have hard response timeouts: Slack 3 s, Shopify 5 s, GitHub 10 s, Stripe 30 s. AI calls typically take 10–60 seconds. When the sender times out, it marks the delivery failed and retries — the workflow processes the same event twice, potentially creating duplicate records, emails, or actions.

Recommended Fix:

Respond to the webhook immediately with a 202 Accepted using a Respond to Webhook node placed before the AI work. Move the AI processing to continue asynchronously after the response.


4Missing timeoutRisk MediumConfidence 90%9 nodes affected
Affected Nodes:
  • Google Gemini Chat Model
  • OpenRouter Chat Model
  • Groq Chat Model
What happens:

A single slow external call can block the entire workflow execution. At high trigger frequency, accumulated stuck executions can exhaust the n8n execution queue.

Recommended Fix:

Set a timeout under the node's Additional Options. A value of 10,000–30,000 ms (10–30 seconds) is a reasonable starting point for most APIs; adjust based on the provider's documented SLA.


5Missing error handlerRisk MediumConfidence 85%11 nodes affected
Affected Nodes:
  • Google Gemini Chat Model
  • OpenRouter Chat Model
  • Groq Chat Model
What happens:

Operators cannot tell from external signals that a run failed. Silent failures go undetected until a downstream system shows missing data or a user reports a problem.

Recommended Fix:

Connect a dedicated Error Workflow in workflow settings, or add a per-node onError: "continueErrorOutput" path that sends an alert via Slack, email, or a logging service.


6Unstructured AI outputRisk MediumConfidence 75%4 nodes affected
Affected Nodes:
  • Creative Prompt Agent
  • Marketing Prompt Agent
  • Technical Prompt Agent
What happens:

Free-form text output varies between invocations. The downstream node assumes a specific format to parse or act on. When the model produces a slightly different structure — different key names, trailing text, markdown formatting — the downstream logic fails intermittently in ways that are hard to debug.

Recommended Fix:

Enable JSON mode (responseFormat: "json") on the AI node or connect an Output Parser sub-node with a defined schema. This forces the model to produce output in a predictable format and fails fast when it does not.


7Missing audit logRisk MediumConfidence 70%1 node affected
Affected Nodes:
  • Create a row
What happens:

If this action is disputed, replayed, or causes a data inconsistency, there is no structured record of what was sent, when, and with what data. Debugging requires cross-referencing n8n execution history with the external system's own logs.

Recommended Fix:

After the write node, add a step that records the key fields of the action to a log — a Google Sheet row append, a database insert to an audit table, or a Slack message to a dedicated ops channel. Include: timestamp, action type, affected ID, and result.


8Webhook write without dedupeRisk MediumConfidence 65%8 nodes affected
Affected Nodes:
  • Webhook
  • Extract Goal
  • Creative Prompt Agent
What happens:

Webhook providers retry on delivery failure. Without a unique key on the target record, a retried delivery creates a duplicate.

Recommended Fix:

Add a unique field to the write operation using a stable identifier from the webhook payload (event ID, order ID, etc.), or add a read-before-write existence check before the write node.


10Agent without iteration limitRisk LowConfidence 85%4 nodes affected
Affected Nodes:
  • Creative Prompt Agent
  • Marketing Prompt Agent
  • Technical Prompt Agent
What happens:

In production, agents can enter loops — repeatedly calling a tool that returns ambiguous results. Without an iteration cap, a single execution can generate hundreds of tool calls, causing unpredictable cost spikes and potentially triggering rate limits on connected APIs.

Recommended Fix:

Set maxIterations to 10–20 for most agentic tasks. Monitor actual iteration counts in execution history and adjust up if legitimate tasks are being cut short.

Cost Hotspots

Currently covers AI/LLM nodes. Non-AI API costs will be added in a future update.

1Agent iteration riskLow exposure10 pts4 nodes affected
Affected Nodes:
  • Creative Prompt Agent
  • Marketing Prompt Agent
  • Technical Prompt Agent
What happens:

no max iterations set

Recommended Fix:

Set maxIterations to 10–20 for most agentic tasks. Monitor actual iteration counts in execution history and adjust up if legitimate tasks are being cut short.

Raw Findings (29)
#Issue titleIssue descriptionAffected nodes
1ReliabilityAI node blocks synchronous webhook response path

Node "Webhook" executes in the synchronous response path of the webhook trigger. The webhook trigger's responseMode is "responseNode", meaning the webhook sender waits for a response before marking delivery complete.

Webhook, Creative Prompt Agent, Marketing Prompt Agent, Technical Prompt AgentHigh85%
2ReliabilityAI output drives downstream logic without a structured format

Node "Best Prompt Evaluator" produces free-form text output that flows into downstream logic with no Output Parser or JSON mode configured.

Best Prompt EvaluatorHigh75%
3ReliabilityExternal call with no timeout configured

Node "Google Gemini Chat Model" makes an external call with no timeout parameter set. The n8n execution will wait indefinitely if the provider is slow or unresponsive.

Google Gemini Chat Model, OpenRouter Chat Model, Groq Chat Model, Cohere Chat Model, Create a row, Creative Prompt Agent, Marketing Prompt Agent, Technical Prompt Agent, Best Prompt EvaluatorHigh90%
4SecurityFinding: webhook no auth

authentication: absent. path: short custom path "__KIPNAI_SAN__WEBHOOK_URL__p7w4FJYj__" (enumerable). downstream write node(s): "Create a row", "Create a row", "Create a row"

Webhook, Create a row, Create a row, Create a rowHigh90%
5ReliabilityFragile expression — likely to fail when production data shape differs from test data

Node "Create a row" contains expression(s) with risky patterns that assume fields are always present.

Create a rowHigh85%
6ReliabilityNo error handler or failure notification path

Workflow has 11 high-risk nodes (external calls or writes) with no configured error workflow and no inline notification path. If a production execution fails, the failure only appears in execution history.

Google Gemini Chat Model, OpenRouter Chat Model, Groq Chat Model, Cohere Chat Model, Create a row, Creative Prompt Agent, Marketing Prompt Agent, Technical Prompt Agent, Best Prompt Evaluator, Extract Goal, Combine Agent OutputsHigh85%
7Cost RiskAI agent has no iteration limit

Agent node "Creative Prompt Agent" has no maxIterations or equivalent parameter. The agent will continue calling tools until it decides to stop or hits a platform-level limit.

Creative Prompt AgentMedium85%
8Cost RiskAI agent has no iteration limit

Agent node "Marketing Prompt Agent" has no maxIterations or equivalent parameter. The agent will continue calling tools until it decides to stop or hits a platform-level limit.

Marketing Prompt AgentMedium85%
9Cost RiskAI agent has no iteration limit

Agent node "Technical Prompt Agent" has no maxIterations or equivalent parameter. The agent will continue calling tools until it decides to stop or hits a platform-level limit.

Technical Prompt AgentMedium85%
10Cost RiskAI agent has no iteration limit

Agent node "Best Prompt Evaluator" has no maxIterations or equivalent parameter. The agent will continue calling tools until it decides to stop or hits a platform-level limit.

Best Prompt EvaluatorMedium85%
11ReliabilityAI output drives downstream logic without a structured format

Node "Creative Prompt Agent" produces free-form text output that flows into downstream logic with no Output Parser or JSON mode configured.

Creative Prompt AgentMedium75%
12ReliabilityAI output drives downstream logic without a structured format

Node "Marketing Prompt Agent" produces free-form text output that flows into downstream logic with no Output Parser or JSON mode configured.

Marketing Prompt AgentMedium75%
13ReliabilityAI output drives downstream logic without a structured format

Node "Technical Prompt Agent" produces free-form text output that flows into downstream logic with no Output Parser or JSON mode configured.

Technical Prompt AgentMedium75%
14ReliabilityFragile expression — likely to fail when production data shape differs from test data

Node "Creative Prompt Agent" contains expression(s) with risky patterns that assume fields are always present.

Creative Prompt AgentMedium75%
15ReliabilityFragile expression — likely to fail when production data shape differs from test data

Node "Marketing Prompt Agent" contains expression(s) with risky patterns that assume fields are always present.

Marketing Prompt AgentMedium75%
16ReliabilityFragile expression — likely to fail when production data shape differs from test data

Node "Technical Prompt Agent" contains expression(s) with risky patterns that assume fields are always present.

Technical Prompt AgentMedium75%
17ReliabilityFragile expression — likely to fail when production data shape differs from test data

Node "Best Prompt Evaluator" contains expression(s) with risky patterns that assume fields are always present.

Best Prompt EvaluatorMedium75%
18ReliabilityHigh fan-out with external calls — partial failure risk at merge point

Workflow fans out into 3 parallel branches, each calling an external service. No per-branch error handling was detected before the merge point.

Extract Goal, Merge, Creative Prompt Agent, Best Prompt Evaluator, Marketing Prompt Agent, Best Prompt Evaluator, Technical Prompt Agent, Best Prompt EvaluatorMedium70%
19ObservabilitySide-effect node has no audit trail

Node "Create a row" performs a write node: "create a row" (sideeffect: external_write) operation with no logging or audit trail detected downstream.

Create a rowMedium70%
20ReliabilityWebhook trigger feeds write operation without unique-key protection

The webhook trigger feeds node "Webhook" without a visible unique key constraint or deduplication step. No ID field parameter was detected in the write node configuration.

Webhook, Create a rowMedium65%
21NamingFinding: poor naming generic

2 node(s) use default/generic names.. Node "Webhook" (n8n-nodes-base.webhook) has a generic default name.. Node "Merge" (n8n-nodes-base.merge) has a generic default name.

Webhook, MergeLow90%
22ReliabilityFinding: external without retry

Node "Google Gemini Chat Model" (@n8n/n8n-nodes-langchain.lmChatGoogleGemini) is a read-only external call with no retry configured.. sideEffect: read_only, role: ai_model_call. Read-only calls are typically safe to retry; enabling retryOnFail improves resilience to transient failures.

Google Gemini Chat ModelInfo70%
23ReliabilityFinding: external without retry

Node "OpenRouter Chat Model" (@n8n/n8n-nodes-langchain.lmChatOpenRouter) is a read-only external call with no retry configured.. sideEffect: read_only, role: ai_model_call. Read-only calls are typically safe to retry; enabling retryOnFail improves resilience to transient failures.

OpenRouter Chat ModelInfo70%
24ReliabilityFinding: external without retry

Node "Groq Chat Model" (@n8n/n8n-nodes-langchain.lmChatGroq) is a read-only external call with no retry configured.. sideEffect: read_only, role: ai_model_call. Read-only calls are typically safe to retry; enabling retryOnFail improves resilience to transient failures.

Groq Chat ModelInfo70%
25ReliabilityFinding: external without retry

Node "Cohere Chat Model" (@n8n/n8n-nodes-langchain.lmChatCohere) is a read-only external call with no retry configured.. sideEffect: read_only, role: ai_model_call. Read-only calls are typically safe to retry; enabling retryOnFail improves resilience to transient failures.

Cohere Chat ModelInfo70%
26ReliabilityFinding: external without retry

Node "Creative Prompt Agent" (@n8n/n8n-nodes-langchain.agent) is a read-only external call with no retry configured.. sideEffect: read_only, role: ai_agent. Read-only calls are typically safe to retry; enabling retryOnFail improves resilience to transient failures.

Creative Prompt AgentInfo70%
27ReliabilityFinding: external without retry

Node "Marketing Prompt Agent" (@n8n/n8n-nodes-langchain.agent) is a read-only external call with no retry configured.. sideEffect: read_only, role: ai_agent. Read-only calls are typically safe to retry; enabling retryOnFail improves resilience to transient failures.

Marketing Prompt AgentInfo70%
28ReliabilityFinding: external without retry

Node "Technical Prompt Agent" (@n8n/n8n-nodes-langchain.agent) is a read-only external call with no retry configured.. sideEffect: read_only, role: ai_agent. Read-only calls are typically safe to retry; enabling retryOnFail improves resilience to transient failures.

Technical Prompt AgentInfo70%
29ReliabilityFinding: external without retry

Node "Best Prompt Evaluator" (@n8n/n8n-nodes-langchain.agent) is a read-only external call with no retry configured.. sideEffect: read_only, role: ai_agent. Read-only calls are typically safe to retry; enabling retryOnFail improves resilience to transient failures.

Best Prompt EvaluatorInfo70%

Catch workflow risks before they catch you