Security Audit
clickhousectl-cloud-deploy
github.com/ClickHouse/agent-skillsTrust Assessment
clickhousectl-cloud-deploy received a trust score of 10/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 6 findings: 2 critical, 2 high, 2 medium, and 0 low severity. Key findings include Arbitrary command execution, Remote code execution: curl/wget pipe to shell, Unsafe installation method via curl | sh.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 56/100, indicating areas for improvement.
Last analyzed on May 1, 2026 (commit d2841614). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings6
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Arbitrary command execution Remote code download piped to interpreter Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands. | Manifest | skills/clickhousectl-cloud-deploy/SKILL.md:46 | |
| CRITICAL | Remote code execution: curl/wget pipe to shell Detected a pattern that downloads and immediately executes remote code. This is a primary malware delivery vector. Never pipe curl/wget output directly to a shell interpreter. | Static | skills/clickhousectl-cloud-deploy/SKILL.md:46 | |
| HIGH | Unsafe installation method via curl | sh The skill instructs users to install `clickhousectl` by piping the output of `curl` directly to `sh`. This method executes arbitrary code downloaded from the internet without prior inspection. While `clickhouse.com` is the official domain, this practice introduces a significant supply chain risk. If the `clickhouse.com` server or the script itself were compromised, malicious code could be executed on the user's system. Recommend a safer installation method, such as downloading a signed binary, using a package manager (e.g., Homebrew, apt, yum), or at least advising the user to inspect the script before execution. For example, `curl -fsSL https://clickhouse.com/cli > clickhousectl_install.sh && less clickhousectl_install.sh && sh clickhousectl_install.sh`. | LLM | SKILL.md:46 | |
| HIGH | Potential command injection via unsanitized user input in clickhousectl arguments The skill instructs users to provide various inputs like `<service-name>`, `<service-id>`, `<table>.sql`, `<view>.sql`, and `<table-name>` as arguments to `clickhousectl` commands. If these user-provided values contain shell metacharacters (e.g., `;`, `&`, `|`, `$()`, `` ` ``) and the `clickhousectl` tool does not properly sanitize or quote these arguments before passing them to the underlying shell, it could lead to arbitrary command injection. An attacker could potentially execute malicious commands on the user's system. Advise users to avoid special shell characters in names and IDs. If the skill were to construct these commands programmatically, it should ensure proper sanitization or quoting of all user-provided arguments before execution. For a markdown skill, this is primarily about user awareness and caution. | LLM | SKILL.md:127 | |
| MEDIUM | API keys and secrets exposed on command line The skill instructs users to provide API keys and secrets directly as command-line arguments (`--api-key <key> --api-secret <secret>`) for `clickhousectl cloud login`. This practice exposes sensitive credentials in shell history files, process lists (`ps aux`), and potentially system logs, making them vulnerable to unauthorized access. While the skill advises using environment variables for application passwords, it does not extend this recommendation to the `clickhousectl` login command itself. Advise users to pass API keys and secrets via environment variables (e.g., `CLICKHOUSE_API_KEY`, `CLICKHOUSE_API_SECRET`) or secure input prompts (if `clickhousectl` supports it) instead of direct command-line arguments. | LLM | SKILL.md:85 | |
| MEDIUM | Recommendation of 'Admin' role for API keys The skill instructs users to create an API key with the 'Admin' role. While this role might be necessary for creating and deleting services as described, it grants broad permissions. If this API key is compromised or used in an automated context where more restricted permissions would suffice (e.g., only read access, or specific service management permissions), it increases the blast radius of a potential security incident. Advise users to follow the principle of least privilege. Suggest creating API keys with the minimum necessary permissions for the intended operations. For example, if only service creation is needed, a role limited to that action should be preferred over a full 'Admin' role. | LLM | SKILL.md:97 |
Scan History
Embed Code
[](https://skillshield.io/report/af956c1426ef7b8e)
Powered by SkillShield