ClawHub
Back to skill

Security audit

ClickHouse

Security checks for vulnerabilities and agentic risk

Overview

The ClickHouse skill is mostly purpose-aligned, but it should go through Review because it can persist sensitive database details and may store passwords in plain text.

Before installing, decide whether you are comfortable with this skill keeping ClickHouse connection profiles, schemas, query patterns, and workload notes under ~/clickhouse/. Do not let it save real database passwords there; use environment variables, clickhouse-client profiles, or a secret manager, prefer HTTPS for remote ClickHouse HTTP access, and use least-privileged database accounts.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:209
Finding

Plaintext Storage of ClickHouse Database Passwords

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 209–218
Vulnerability Type: Plaintext credential storage
Risk Level: Medium

Vulnerable Code:

markdown
**Data saved locally (with user consent):**
- Connection profiles (host, port, database) in ~/clickhouse/memory.md
- Query patterns and schema documentation
- Authentication method preferences (password vs certificate)

**Important:** If you provide database passwords, they are stored in plain text in ~/clickhouse/. Consider using environment variables or connection profiles managed by clickhouse-client instead.

Technical Analysis

The Skill explicitly states that database passwords supplied by users are stored in plaintext under ~/clickhouse/. Plaintext credential persistence lacks confidentiality protection and can expose database credentials to any actor or process able to read the relevant files.

This instruction also conflicts with memory-template.md, which states that passwords must never be stored in the memory file. The inconsistent guidance may cause an Agent to follow the less secure behavior in SKILL.md. No requirement is provided for restrictive directory or file permissions.

Attack Path

  1. A user supplies a ClickHouse password while configuring a connection.
  2. The Agent follows the documented behavior and writes the password beneath ~/clickhouse/.
  3. The file is exposed through permissive filesystem permissions, local malware, backup software, synchronization tools, or accidental archive or repository inclusion.
  4. An attacker or unauthorized local process reads the plaintext credential.
  5. The attacker uses the credential to authenticate to the configured ClickHouse instance.

Impact Assessment

Successful exploitation exposes the privileges granted to the compromised ClickHouse account. Depending on that account's permissions, an attacker could read analytical data, modify or delete tables, submit ...[truncated 275 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove all instructions permitting database passwords to be stored in ~/clickhouse/.
  • Make SKILL.md consistent with memory-template.md by explicitly prohibiting secret persistence in memory files.
  • Store only the name of an environment variable, secret-manager reference, or named clickhouse-client profile.
  • If persistent secret storage is essential, use an operating-system keychain or dedicated secret manager rather than a Markdown file.
  • Require directory permissions of 0700 for ~/clickhouse/ and file permissions of 0600 for non-secret connection metadata.
  • Add validation instructing the Agent to redact passwords from generated files, logs, responses, and saved command examples.
  • Recommend a dedicated, least-privileged ClickHouse account and credential rotation if plaintext storage has already occurred.

T09 · Insecure Skill Coding Practices

Warning
Location
ingestion.md:32
Finding

ClickHouse Password Exposed Through Command-Line URL

Content
View full analysis

Vulnerability Details

File Location: ingestion.md, lines 32–35
Vulnerability Type: Credential exposure through command arguments, URLs, and plaintext transport
Risk Level: Medium

Vulnerable Code:

bash
# With authentication
curl 'http://localhost:8123/?user=default&password=xxx' \
  --data-binary @data.json \
  -H "X-ClickHouse-Query: INSERT INTO events FORMAT JSONEachRow"

Technical Analysis

The authentication example places the ClickHouse password directly in a URL supplied as a command-line argument. If a user replaces xxx with a real password, the credential may be retained in shell history and exposed through process inspection, terminal capture, debugging output, command auditing, or HTTP access logs. Query-string credentials are especially likely to be logged by clients, proxies, and servers.

The example also uses unencrypted HTTP. Although the documented endpoint is loopback-only, users may adapt the command to a remote host. In that case, the username, password, query, and uploaded data could traverse the network without transport encryption.

Attack Path

  1. A user copies the documented command and replaces xxx with a valid ClickHouse password.
  2. The shell records the command in its history, or the running command becomes visible through process-monitoring facilities.
  3. Alternatively, the URL containing the password is retained by HTTP server, proxy, audit, or diagnostic logs.
  4. A local user, administrator, compromised monitoring component, or log consumer retrieves the exposed credential.
  5. If the example is adapted to a remote HTTP endpoint, a network-positioned attacker may also observe the unencrypted request.
  6. The attacker authenticates to ClickHouse using the recovered credential.

Impact Assessment

Exploitation grants the attacker the permissions of the exposed ClickHouse account. Potential consequences include unauthorized data access, inserti ...[truncated 340 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove passwords from query strings and command-line arguments.
  • Use a protected clickhouse-client configuration profile, an environment-backed secret reference, an operating-system keychain, or a dedicated secret manager.
  • If curl must be used, load authentication settings from a temporary configuration file protected with 0600 permissions and securely delete it afterward; avoid exposing secrets in process arguments.
  • Use HTTPS with certificate verification for every non-loopback ClickHouse HTTP connection.
  • Configure clients, proxies, and ClickHouse access logs to redact authentication data and query parameters.
  • Use a dedicated, least-privileged ingestion account rather than the default account.
  • Rotate any password previously entered through the documented URL pattern and review shell history and relevant logs for residual copies.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 230)May include surrounding context.

md
**This skill does NOT:**
- Connect to any ClickHouse without explicit user configuration
- Send data to external services
- Automatically collect or store credentials without asking

## Related Skills

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 230)May include surrounding context.

md
**This skill does NOT:**
- Connect to any ClickHouse without explicit user configuration
- Send data to external services
- Automatically collect or store credentials without asking

## Related Skills

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

md
**This skill does NOT:**
- Connect to any ClickHouse without explicit user configuration
- Send data to external services
- Automatically collect or store credentials without asking

## Related Skills
Install with `clawhub install <slug>` if user confirms:

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The example sends data and, in one variant, credentials over plain HTTP to the ClickHouse server. Even though localhost is shown, the documented pattern normalizes insecure transport; if adapted to remote hosts or containerized environments, it can expose sensitive data and credentials to interception or leakage.

Content

Scanner excerpt · ingestion.md (reported line 37)May include surrounding context.

bash
# JSON via HTTP
curl 'http://localhost:8123/?query=INSERT%20INTO%20events%20FORMAT%20JSONEachRow' \
  --data-binary @data.json

# With authentication

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The authenticated HTTP example embeds credentials directly in a URL using a placeholder password, but gives no warning against putting real secrets in commands, shell history, logs, or process listings. In a database administration skill, users may copy this pattern into production, which can lead to credential exposure and unauthorized database access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The S3 example shows access key and secret parameters directly in the query without any guidance on secret handling. This is dangerous because such values are often copied into query history, notebooks, logs, and monitoring systems, exposing cloud credentials that could allow unauthorized access to storage or broader cloud resources.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · ingestion.md (reported line 137)May include surrounding context.

sql
-- Fetch and insert from URL
INSERT INTO events
SELECT * FROM url('https://api.example.com/events', JSONEachRow);

Deduplication

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The instruction to act when ~/clickhouse/ doesn't exist and to 'Start the conversation naturally' does not specify a concrete trigger phrase or narrow invocation context. This makes activation criteria unclear and risks the skill engaging in ordinary conversation without users understanding why it activated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs persistent saving of connection details like host, port, database, auth method, and cluster status to ~/clickhouse/memory.md without clear notice or consent about local retention. Even if credentials are not fully captured, infrastructure metadata is sensitive and could expose internal topology or facilitate later compromise if the host is accessed by another user or process.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The instructions direct ongoing collection and persistence of user connection profile information in internal files without minimization or sensitivity controls. In a database administration context, even partial environment details can reveal internal services, deployment patterns, and privileged access paths, increasing the blast radius of local compromise or unintended disclosure.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The broader memory instructions encourage retention of schemas, table definitions, optimization notes, data scale, and pain points in local files. In the ClickHouse context, schemas and workload characteristics can contain proprietary business logic, internal naming, or sensitive operational information, making this more dangerous than generic note-taking.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.