ClawHub
Back to skill

Security audit

ClickHouse

Security checks across malware telemetry and agentic risk

Overview

This ClickHouse skill is mostly a normal database connector, but it under-discloses that its SQL action may be able to change or delete database state.

Review before installing. Use it only with ClickHouse accounts where you are comfortable letting the agent run SQL, and require explicit review of any execute_query payload unless you know the backend enforces read-only queries.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The skill metadata promises only 'searching and reading data,' but the documented `execute_query` action explicitly allows arbitrary SQL execution. In ClickHouse, arbitrary SQL may include DDL or other state-changing operations, so this mismatch can cause an agent or user to treat a write-capable interface as read-only and execute unsafe queries without proper confirmation.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The safety section says untagged actions are safe reads, yet `execute_query` is untagged despite being described as executing arbitrary SQL queries. This directly undermines the safety model and may cause an autonomous agent to run mutating or destructive SQL under the false assumption that the action is read-only.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The trigger text says to use this skill for 'ANY ClickHouse request,' which is unusually broad and can force invocation even when a safer or more specialized path would be preferable. In combination with the misleading read-only framing and arbitrary-query capability, this increases the chance of unintended use of a risky action surface.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.