Skillv1.0.0

ClawScan security

Clickhouse Best Practices · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 9, 2026, 8:43 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's files and runtime instructions are consistent with a ClickHouse best-practices reviewer: it is instruction-only, requires no credentials or installs, and its rules align with the stated purpose.
Guidance: This skill appears coherent and focused: it bundles a comprehensive set of ClickHouse rules and gives a clear output format for reviews. Before installing, consider: (1) whether the agent is allowed to access the public web (the skill may perform network searches when rules are missing); (2) validate that the suggested best-practices match your ClickHouse version and organizational constraints (some recommendations depend on ClickHouse 24.x+ features); and (3) test any schema or write-policy changes in staging — the rules are prescriptive and can require heavyweight migrations (e.g., changing ORDER BY requires table migration). There are no requests for credentials or installs, so the direct security risk from this skill bundle is low.

Purpose & Capability: okName, description, and the included rules (28 rule files) all relate to ClickHouse schema/query/write optimizations. There are no unrelated environment variables, binaries, or install steps requested — the required surface is proportionate to the stated purpose.
Instruction Scope: noteSKILL.md confines runtime behavior to consulting the rules/ directory and applying rule-based checks. It also allows falling back to LLM knowledge or network searches when no rule applies; that fallback is reasonable for keeping advice current but is an open-ended permission to fetch external web content. The skill does not instruct reading local system files or environment variables beyond its own bundle.
Install Mechanism: okNo install spec and no code to execute — instruction-only skill. Nothing will be downloaded or written to the agent's environment by the skill itself.
Credentials: okRequires no environment variables, credentials, or config paths. The guidance and rule files do not request secrets or access to unrelated services.
Persistence & Privilege: okalways:false and default invocation settings. The skill does not request persistent/system-wide privileges or modify other skills' configurations.