Security audit

Clickhouse for Developers

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent ClickHouse reference skill with some examples that need operational caution, but I found no hidden execution, persistence, exfiltration, or purpose-mismatched behavior.

Install only if you are comfortable using it as ClickHouse operational guidance. Before copying examples, pin dependencies, use least-privileged database accounts, store secrets outside command arguments and committed .env files, require TLS for non-local ClickHouse connections, and manually review any DELETE, DROP, TTL, migration, or ON CLUSTER command before running it.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:576
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation
--save-exact pip install clickhouse-connect== pip install clickhouse-driver== ``` 2. Commit and enforce ecosystem lockfiles, such as `package-lock.json`, and use reproducible CI commands such as `npm ci`. 3. For Python deployments, maintain a reviewed requirements file with hashes and install using: ```bash pip install --require-hashes -r requirements.txt ``` 4. Retrieve packages only from approved registries and configure registry allowlists where possible. 5. Run dependency vulnerability, provenance, and license checks before approving upgrades. 6. Execute package installation in an isolated, least-privileged build environment without unnecessary production secrets. 7. Establish a controlled update process so version changes are reviewed rather than silently inherited. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:450
Finding: Database Credentials May Be Exposed Through Process Arguments or Plaintext Transport
Content: View full analysis
-u --password -d # Using env vars (recommended — hides password from process list) export CLICKHOUSE_PASSWORD=yourpassword clickhouse-client -h 127.0.0.1 -u app_user -d app_db ``` ```javascript _client = createClient({ url: process.env.CLICKHOUSE_URL ?? 'http://localhost:8123', username: process.env.CLICKHOUSE_USER ?? 'default', password: process.env.CLICKHOUSE_PASSWORD ?? '', database: process.env.CLICKHOUSE_DB ?? 'default', clickhouse_settings: { async_insert: 1, wait_for_async_insert: 1, async_insert_busy_timeout_ms: 1000, }, compression: { request: true }, request_timeout: 30_000, }); ``` ```env CLICKHOUSE_URL=http://localhost:8123 CLICKHOUSE_USER=default CLICKHOUSE_PASSWORD=secret CLICKHOUSE_DB=analytics ``` ```python return clickhouse_connect.get_client( host=os.environ.get('CLICKHOUSE_HOST', 'localhost'), port=int(os.environ.get('CLICKHOUSE_PORT', 8123)), username=os.environ.get('CLICKHOUSE_USER', 'default'), password=os.environ.get('CLICKHOUSE_PASSWORD', ''), database=os.environ.get('CLICKHOUSE_DB', 'default'), ) ``` ### Technical Analysis Passing a password directly through `--password ` places the credential in the command-line argument vector. Depending on operating-system configuration, process arguments may be observable by other local users, monitoring agents, process supervisors, shell auditing, diagnostic tooling, or command-history mechanisms. The backend examples also permit `http://` connections and do not enforce TLS when configuration changes from `localhost` to a remote host. Compression does not provide confidentiality. If a user copies the example and configures a ...[truncated 2442 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The activation rule is overly broad, requiring use whenever a user merely mentions ClickHouse or adjacent analytics topics. Broad mandatory activation can cause unnecessary loading of irrelevant instructions and increase prompt-surface area, which raises the risk of instruction collisions, reduced adherence to higher-priority policies, or unintended data/tool suggestions in contexts where the skill is not actually needed.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · rules/schema-partition-lifecycle.md (reported line 37)May include surrounding context.
-- Instant deletion of old data ALTER TABLE events DROP PARTITION '2023-01';

-- TTL automatically removes expired data

text
**Lifecycle use cases:**

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The guidance encourages replacing NULL with placeholder defaults like empty string or 0 even when those values can carry different business meaning. In analytics systems this can silently corrupt data semantics, break downstream aggregations and filters, and make it impossible to distinguish 'unknown', 'not applicable', and real zero/empty values.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The manifest presents this as a comprehensive ClickHouse skill focused on working with a ClickHouse analytics database, but this section provides substantive implementation guidance for Redis caching behavior and cache-key/TTL patterns. While adjacent to ClickHouse performance architecture, Redis-specific operational code is a separate capability not strictly required to explain ClickHouse usage itself.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The inline documentation says clickhouse-connect is an 'Official Anthropic-maintained driver', but the code is discussing a ClickHouse client library and nothing else in the file supports that ownership claim. This is an active documentation contradiction/misstatement about what dependency is being recommended, which can mislead developers about provenance and trust.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.