Security Audit

affaan-m/everything-claude-code:.cursor/skills/clickhouse-io

github.com/affaan-m/everything-claude-code

AI SkillCommit db27ba1eb225

CRITICAL

Scanned about 1 month ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

affaan-m/everything-claude-code:.cursor/skills/clickhouse-io received a trust score of 40/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.

SkillShield's automated analysis identified 1 finding: 1 critical, 0 high, 0 medium, and 0 low severity. Key findings include SQL Injection via string concatenation in ClickHouse queries.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.

Last analyzed on February 24, 2026 (commit db27ba1e). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

100%

Static Code Analysis

70%

Dependency Graph

100%

LLM Behavioral Safety

100%

Behavioral Risk Signals

Shell Execution

1 finding

Dynamic Code

1 finding

Excessive Permissions

1 finding

Security Findings1

Severity	Finding	Layer	Location
CRITICAL	SQL Injection via string concatenation in ClickHouse queries The `bulkInsertTrades` function (lines 109-118) and `insertTrade` function (lines 123-126) demonstrate constructing SQL `INSERT` statements by directly concatenating string values (e.g., `trade.id`, `trade.market_id`, `trade.user_id`, `trade.timestamp.toISOString()`) into the query string. If any of these values originate from untrusted user input, a malicious actor could inject arbitrary SQL commands. This vulnerability can lead to unauthorized data access, modification, deletion, or even full database compromise. Always use parameterized queries or the `clickhouse.insert` method with structured data when dealing with user-provided or potentially untrusted input. For `clickhouse.query`, use the parameter object syntax (e.g., `clickhouse.query('INSERT INTO trades (id, market_id) VALUES ({id:String}, {market_id:String})', { id: trade.id, market_id: trade.market_id })`). This allows the client library to properly escape or bind values, preventing SQL injection.	Static	SKILL.md:115

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/792652273eaed2ca.svg)](https://skillshield.io/report/792652273eaed2ca)