kipn.ai
Shared workflow report

24. AI Client Onboarding Agent: Auto Welcome Email Generator

Analyzed

Executive Summary
n8n
Production RiskMedium

External call with no timeout configured — A single slow external call can block the entire workflow execution. At high trigger frequency, accumulated stuck executions can exhaust the n8n execution queue.

Cost ExposureHigh

AI node has no output token cap — Without a cap, models occasionally produce very long outputs — particularly when given an ambiguous or open-ended prompt. This increases cost unpredictably and can cause downstream parsing to fail if the consumer expects a bounded response.

Observability Gap

Side-effect node has no audit trail — If this action is disputed, replayed, or causes a data inconsistency, there is no structured record of what was sent, when, and with what data. Debugging requires cross-referencing n8n execution history with the external system's own logs.

67/ 100
Overall
Risk: MediumCost: High
Reliability
27
Security
100
Cost Risk
69
Observability
92
AI Governance
100
Naming
100
Complexity
100
Nodes
15
Edges
7
External calls
3
LLM nodes
2
AI via HTTP
0
Loops
0
Error handlers
1
Unreachable
0
Max depth
4
Workflow Graph
Graph
15 nodes · 7 edges
100%
click a node to highlight its upstream & downstream paths
Controls Matrix
Present Partial Missing
CheckDescriptionStatus
Failure Alerting

Failures silent — only visible in execution log

Missing
Retry on Failure

Transient failures cause permanent stops

Present
Request Timeouts

Slow providers can block execution indefinitely

Missing
Duplicate Prevention

Retry on write events creates duplicate records

Missing
Empty Response Handling

Zero-result lookups break downstream logic

Present
AI Output Limits

Output cost and parsing risk unbounded

1 of 2 AI nodes missing token cap

Partial
AI Output Format

Free-form output will break downstream parsers

1 of 2 AI nodes lack structured output

Partial
Activity Logging

Side effects unlogged

Missing
Write Deduplication

Webhook replays may create duplicate records

Present

Run this analysis on your own workflows

Break Points
1Missing timeoutRisk MediumConfidence 90%3 nodes affected
Affected Nodes:
  • Google Gemini Chat Model
  • Personalize Using Gemini
  • Send Email to Client
What happens:

A single slow external call can block the entire workflow execution. At high trigger frequency, accumulated stuck executions can exhaust the n8n execution queue.

Recommended Fix:

Set a timeout under the node's Additional Options. A value of 10,000–30,000 ms (10–30 seconds) is a reasonable starting point for most APIs; adjust based on the provider's documented SLA.


2Fragile expressionRisk MediumConfidence 85%1 node affected
Affected Nodes:
  • Personalize Using Gemini
What happens:

These expressions work reliably against test data where all fields are present. In production, fields may be absent, null, or differently typed — causing a runtime error or silent null propagation at the point of the expression.

Recommended Fix:
  • In `text`, change {{ $('Trigger on New Client Form Submission').item.json['Client name'] }} to {{ $('Trigger on New Client Form Submission')?.item?.json['Client name'] }}.
  • In `text`, change {{ $json.Checklist }} to {{ $json?.Checklist }}.
  • In `text`, change {{ $('Extract and Structure Client Data').item.json.fields }} to {{ $('Extract and Structure Client Data')?.item?.json?.fields }}.

3Fragile expressionRisk MediumConfidence 85%1 node affected
Affected Nodes:
  • Send Email to Client
What happens:

These expressions work reliably against test data where all fields are present. In production, fields may be absent, null, or differently typed — causing a runtime error or silent null propagation at the point of the expression.

Recommended Fix:
  • In `sendTo`, change {{ $('Trigger on New Client Form Submission').item.json[' email '] }} to {{ $('Trigger on New Client Form Submission')?.item?.json[' email '] }}.
  • In `message`, change {{ $json.text }} to {{ $json?.text }}.
  • In `subject`, change {{ $('Trigger on New Client Form Submission').item.json['Client name'] }} to {{ $('Trigger on New Client Form Submission')?.item?.json['Client name'] }}.

4Missing error handlerRisk MediumConfidence 85%7 nodes affected
Affected Nodes:
  • Execution Completed
  • Execution Failure
  • Client Checklist
What happens:

Operators cannot tell from external signals that a run failed. Silent failures go undetected until a downstream system shows missing data or a user reports a problem.

Recommended Fix:

Connect a dedicated Error Workflow in workflow settings, or add a per-node onError: "continueErrorOutput" path that sends an alert via Slack, email, or a logging service.


5No AI token capRisk MediumConfidence 85%1 node affected
Affected Nodes:
  • Personalize Using Gemini
What happens:

Without a cap, models occasionally produce very long outputs — particularly when given an ambiguous or open-ended prompt. This increases cost unpredictably and can cause downstream parsing to fail if the consumer expects a bounded response.

Recommended Fix:

Set maxTokens to a value appropriate for the task. Classification tasks rarely need more than 100 tokens; structured JSON output typically needs 200–500; long-form summaries may need 1,000–2,000. Start conservative and increase if needed.


6Unstructured AI outputRisk MediumConfidence 75%1 node affected
Affected Nodes:
  • Personalize Using Gemini
What happens:

Free-form text output varies between invocations. The downstream node assumes a specific format to parse or act on. When the model produces a slightly different structure — different key names, trailing text, markdown formatting — the downstream logic fails intermittently in ways that are hard to debug.

Recommended Fix:

Enable JSON mode (responseFormat: "json") on the AI node or connect an Output Parser sub-node with a defined schema. This forces the model to produce output in a predictable format and fails fast when it does not.


7Missing audit logRisk MediumConfidence 70%1 node affected
Affected Nodes:
  • Send Email to Client
What happens:

If this action is disputed, replayed, or causes a data inconsistency, there is no structured record of what was sent, when, and with what data. Debugging requires cross-referencing n8n execution history with the external system's own logs.

Recommended Fix:

After the write node, add a step that records the key fields of the action to a log — a Google Sheet row append, a database insert to an audit table, or a Slack message to a dedicated ops channel. Include: timestamp, action type, affected ID, and result.


8Agent without iteration limitRisk LowConfidence 85%1 node affected
Affected Nodes:
  • Personalize Using Gemini
What happens:

In production, agents can enter loops — repeatedly calling a tool that returns ambiguous results. Without an iteration cap, a single execution can generate hundreds of tool calls, causing unpredictable cost spikes and potentially triggering rate limits on connected APIs.

Recommended Fix:

Set maxIterations to 10–20 for most agentic tasks. Monitor actual iteration counts in execution history and adjust up if legitimate tasks are being cut short.


9Large AI prompt payloadRisk LowConfidence 80%1 node affected
Affected Nodes:
  • Personalize Using Gemini
What happens:

Token costs scale with the size of the payload. A full $json object or a field containing HTML, transcripts, or email bodies can be orders of magnitude larger than the task actually requires.

Recommended Fix:

Select only the fields the model needs for its task. If the content must be large (e.g., summarizing a full document), set a maxTokens output cap and consider chunking the input across multiple calls.


10Fragile expressionRisk LowConfidence 75%1 node affected
Affected Nodes:
  • Extract and Structure Client Data
What happens:

These expressions work reliably against test data where all fields are present. In production, fields may be absent, null, or differently typed — causing a runtime error or silent null propagation at the point of the expression.

Recommended Fix:
  • In `assignments.assignments[0].value`, change {{ $json['Client name'] }} to {{ $json['Client name'] ?? '' }}.
Cost Hotspots

Currently covers AI/LLM nodes. Non-AI API costs will be added in a future update.

1Multiple cost risksHigh exposure40 pts1 node affected
Affected Nodes:
  • Personalize Using Gemini
Cost risks:
  • Full payload in promptunbounded input tokens
  • No output capunbounded output tokens
  • Agent iteration riskno max iterations set
Recommended Fix:

Set maxTokens to a value appropriate for the task. Classification tasks rarely need more than 100 tokens; structured JSON output typically needs 200–500; long-form summaries may need 1,000–2,000. Start conservative and increase if needed.

Raw Findings (12)
#Issue titleIssue descriptionAffected nodes
1Cost RiskAI node has no output token cap

Node "Personalize Using Gemini" has no maxTokens or equivalent parameter set. Output length is controlled solely by the model.

Personalize Using GeminiHigh85%
2ReliabilityAI output drives downstream logic without a structured format

Node "Personalize Using Gemini" produces free-form text output that flows into downstream logic with no Output Parser or JSON mode configured.

Personalize Using GeminiHigh75%
3ReliabilityExternal call with no timeout configured

Node "Google Gemini Chat Model" makes an external call with no timeout parameter set. The n8n execution will wait indefinitely if the provider is slow or unresponsive.

Google Gemini Chat Model, Personalize Using Gemini, Send Email to ClientHigh90%
4ReliabilityFragile expression — likely to fail when production data shape differs from test data

Node "Personalize Using Gemini" contains expression(s) with risky patterns that assume fields are always present.

Personalize Using GeminiHigh85%
5ReliabilityNo error handler or failure notification path

Workflow has 7 high-risk nodes (external calls or writes) with no configured error workflow and no inline notification path. If a production execution fails, the failure only appears in execution history.

Execution Completed, Execution Failure, Client Checklist, Google Gemini Chat Model, Extract and Structure Client Data, Personalize Using Gemini, Send Email to ClientHigh85%
6Cost RiskAI agent has no iteration limit

Agent node "Personalize Using Gemini" has no maxIterations or equivalent parameter. The agent will continue calling tools until it decides to stop or hits a platform-level limit.

Personalize Using GeminiMedium85%
7ReliabilityFragile expression — likely to fail when production data shape differs from test data

Node "Send Email to Client" contains expression(s) with risky patterns that assume fields are always present.

Send Email to ClientMedium85%
8Cost RiskFull or large payload detected in AI prompt

Node "Personalize Using Gemini" receives text: large-payload keyword 'body' in its prompt parameter. This sends an unbounded amount of data to the model.

Personalize Using GeminiMedium80%
9ObservabilitySide-effect node has no audit trail

Node "Send Email to Client" performs a write node: "send email to client" (sideeffect: external_write) operation with no logging or audit trail detected downstream.

Send Email to ClientMedium70%
10ReliabilityFragile expression — likely to fail when production data shape differs from test data

Node "Extract and Structure Client Data" contains expression(s) with risky patterns that assume fields are always present.

Extract and Structure Client DataLow75%
11ReliabilityFinding: external without retry

Node "Google Gemini Chat Model" (@n8n/n8n-nodes-langchain.lmChatGoogleGemini) is a read-only external call with no retry configured.. sideEffect: read_only, role: ai_model_call. Read-only calls are typically safe to retry; enabling retryOnFail improves resilience to transient failures.

Google Gemini Chat ModelInfo70%
12ReliabilityFinding: external without retry

Node "Personalize Using Gemini" (@n8n/n8n-nodes-langchain.chainLlm) is a read-only external call with no retry configured.. sideEffect: read_only, role: ai_agent. Read-only calls are typically safe to retry; enabling retryOnFail improves resilience to transient failures.

Personalize Using GeminiInfo70%

Catch workflow risks before they catch you