Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
ClickHouse
v1.0.1Query, optimize, and administer ClickHouse OLAP databases with schema design, performance tuning, and data ingestion patterns.
⭐ 1· 527·3 current·3 all-time
byIván@ivangdavila
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the content: the skill is an instruction-only ClickHouse assistant. It only requires clickhouse-client and offers guidance on schema, ingestion, queries, and admin tasks — all consistent with an OLAP DB helper.
Instruction Scope
Instructions tell the agent to read setup.md on first use and to create/read files under ~/clickhouse/ (memory.md, schemas/, queries/). Saving connection profiles and table definitions is explicit. This is coherent for the skill, but it means the agent will read/write files in the user's home directory (avoid storing passwords in memory.md as the skill itself also recommends).
Install Mechanism
Install spec is a Homebrew formula (clickhouse) producing clickhouse-client. Homebrew is a standard, low-risk package source for macOS/Linuxbrew and matches the required binary; no arbitrary URLs or extraction steps are present.
Credentials
The skill declares no required environment variables or credentials (primaryEnv none). Documentation includes examples for S3, Kafka, and HTTP ingestion that mention credentials (AWS_KEY/AWS_SECRET, kafka broker strings) but those are examples — the skill does not demand unrelated secrets. Users should avoid placing secrets in ~/clickhouse/memory.md and instead use env vars or client profiles as suggested.
Persistence & Privilege
always:false (no forced inclusion). The skill persists only under ~/clickhouse/ per its docs (connection profiles, schemas, saved queries). This is appropriate for a DB helper. The skill does not request modification of other skills or system-wide settings.
Assessment
This skill appears to be what it claims: a ClickHouse helper that expects clickhouse-client and will create/read files under ~/clickhouse/ (memory.md, schemas/, queries/). Before installing or invoking it: (1) Confirm you have or want clickhouse-client installed (Homebrew formula is offered). (2) Review any files created in ~/clickhouse/ and do not store plaintext passwords there — follow the skill's own advice to use env vars or clickhouse-client profiles. (3) Be cautious when following examples that reference S3, Kafka, or URL ingestion: those examples may require cloud credentials or will connect to the remote endpoints you specify. (4) If you want to restrict filesystem writes, plan to inspect or sandbox the agent's file operations. Otherwise the skill's required access and instructions are proportionate to its purpose.Like a lobster shell, security has layers — review code before you run it.
latestvk976j6rchara3jt653jfabp72581xpcd
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🏠 Clawdis
OSLinux · macOS
Binsclickhouse-client
Install
Install ClickHouse (Homebrew)
Bins: clickhouse-client
brew install clickhouse