Agent skill · Audited from source
clickhouse-js-node-rowbinary
skill · clickhouse/agent-skillsApache-2.0 licenceAudited 26 Oct 2026 · source 26841bf3d95f
Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 26841bf3d95f and found no filesystem, network or shell access and no hard-coded secrets. What it does: Generate TypeScript/JavaScript code that reads/decodes AND writes/encodes ClickHouse RowBinary streams for the ClickHouse HTTP server. Use this skill whenever a user wants to parse or produce `RowBinary`,…
Cite
Cite this page
ModelsAtlas. “clickhouse-js-node-rowbinary (clickhouse/agent-skills)”. Retrieved 26 Oct 2026. https://modelsatlas.com/skills/clickhouse/clickhouse-js-node-rowbinary
Trust audit
Audit 0.4.1 · source read 26 Oct 2026
SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 16,667 of 17,602 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesNot pinnedSome versions float
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 1 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | PASS | 1 |
L2 Instructions | Prompt injection, authority framing, hidden directives | PASS | 0 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (2)
LOWInventory / provenanceinv.binary · tests/Dynamic.test.ts
Dynamic.test.ts
- Why
- a compiled or binary member cannot be reviewed from source
- Fix
- ship source, or explain the binary in the README
LOWSupply chainsupply.unpinned · package.json
@clickhouse/datatype-parser, typescript, vitest
- Why
- 3 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
Audit 0.4.1 · source sha 26841bf3d95f · 26 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publisherclickhouse GitHub organizationOwner of the repository this skill is read from
- Source folderclickhouse/agent-skills/skills/clickhouse-js-node-rowbinaryThe exact folder we audited
- LicenceApache-2.0As the repository states it
- Commit pinned for this verdict26841bf3d95fA new audit runs when the source changes
- Repository statusNot archivedPushed today
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Generate TypeScript/JavaScript code that reads/decodes AND writes/encodes ClickHouse RowBinary streams for the ClickHouse HTTP server. Use this skill whenever a user wants to parse or produce `RowBinary`,…
--- name: clickhouse-js-node-rowbinary description: > Generate TypeScript/JavaScript code that reads/decodes AND writes/encodes ClickHouse RowBinary streams for the ClickHouse HTTP server. Use this skill whenever a user wants to parse or produce `RowBinary`, `RowBinaryWithNames`, or `RowBinaryWithNamesAndTypes`. Node.js only, doesn't cover browsers. --- # ClickHouse JS RowBinary Codec Generator for Node.js This skill generates both directions of the wire format: **readers** (decode bytes → values) and **writers** (encode values → bytes, the mirror). A given task normally needs only one side. This file is the shared entry point — the format gate plus the principles common to both directions; the per-direction decisions, guidance, and the per-type reference tables live in two sibling files. **Pick your side — read only the one you need:** - **Decoding a `RowBinary*` response** from ClickHouse into JS values → **[reader.md](reader.md)**. Streaming vs whole-buffer, row-objects vs columnar, fixed vs runtime schema, and the per-type reader reference. - **Encoding JS values into a `RowBinary` payload** to send to ClickHouse → **[writer.md](writer.md)**. The `Sink`/`writeX` building blocks, `writeRows` streaming, and the per-type writer reference. The per-type code is real, split by direction under `src/readers/` and `src/writers/`. ## First: is RowBinary even the right format? RowBinary exists for throughput, but it is **not automatically the fastest path** — match the format to the shape of the data before committing to a bespoke parser. **Prefer a `JSON*` format (e.g. `JSONEachRow`) when** the result is mostly strings / JSON-like values that you consume wholesale — randomly accessing essentially every field, running string/regexp methods on them, treating values as text. V8's native `JSON.parse` is heavily optimized C++ and builds JS strings and objects faster than a JS-level RowBinary decoder can; pair it with HTTP response compression (`gzip` / `zstd`, which crushes JSON's repetitive keys) and the wire cost shrinks too. **RowBinary clearly wins when** the result is dominated by: - **Wide numerics** — `Int128`/`Int256`/`UInt128`/`UInt256`, `Decimal128`/`Decimal256`. - **Binary / fixed-width blobs** — `IPv4`, `IPv6`, `UUID`, `FixedString`. - **High-volume fixed-width numeric columns** generally, where each value is a single `DataView` read. **Prefer the `Native` format when** columnar load and client-side analytics are the main goal (fold/scan/filter columns, feed typed arrays to a Worker or WASM). `Native` is column-major, so it loads straight into one typed array per column with no transpose. For help choosing and consuming a `JSON*` format (or CSV / TSV) instead, use the **`clickhouse-js-node-coding`** skill. ## Core guidance (both directions) These principles apply whether you are generating a reader or a writer; the side-specific operational guidance is in [reader.md](reader.md) / [writer.md](writer.md). - **Little-endian only.** RowBinary is little-endian; target x86/ARM. Read and write every multi-byte number with `DataView` accessors passing a **literal** `true` for the `littleEndian` flag. - **Correct first, then optimize.** First emit a correct codec built from the plain per-type API. Only after it's correct (and tested) specialize it. Don't bake performance assumptions in before correctness. - **Monomorphize generic/composite types.** Emit specialized, inlined code per type combination instead of passing functions as arguments where the type is known ahead of time. - **Inline the leaf ops.** The per-type `readX`/`writeX` functions are the correct, composable reference; the generated codec should INLINE their bodies, not call them, so the row loop is straight-line with no per-field indirection (and so the fixed-width coalescing can fold the offset arithmetic together). - **Annotate the type per column.** Inlining erases the type structure, so put a short comment above each column's encode/decode block naming the ClickHouse type it handles. - **Shared scratch is not reentrant.** Some hot methods reuse a module-level scratch buffer as a write-then-read pair — correct only because the access is fully synchronous. An `async`/`yield` boundary between populating and reading it corrupts the value. - **TypeScript by default.** Generate TypeScript code and helpers unless the user explicitly asks for plain JavaScript. ## Worked examples Six end-to-end examples with real speedup are catalogued in [EXAMPLES.md](EXAMPLES.md). ## Out of scope - **JSON / CSV / TSV / Parquet parsing** → use `clickhouse-js-node-coding`. - **Connection errors, hangs, type mismatches** → use `clickhouse-js-node-troubleshooting`. - **Browser / Web Worker / Edge** → `@clickhouse/client-web`. ## Still Stuck? - [ClickHouse RowBinary format](https://clickhouse.com/docs/interfaces/formats#rowbinary) - [ClickHouse data types](https://clickhouse.com/docs/sql-reference/data-types) - [ClickHouse JS client docs](https://clickhouse.com/docs/integrations/javascript)
Excerpt, first 5,097 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 26841bf
npm install @clickhouse/rowbinary npx skills add ClickHouse/clickhouse-js/skills/clickhouse-js-node-rowbinary
git clone https://github.com/clickhouse/agent-skills git -C agent-skills checkout 26841bf3d95f
Commands as the repository documents them: shown, never run by us. Our verdict covers commit 26841bf3d95f only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| Claude Code | Mentioned in its text, not tested | Skills for Claude Code · About Claude Code |
| Cursor | Mentioned in its text, not tested | Skills for Cursor · About Cursor |
Audit history
Every audit, every source change
- ✓SAFE B 89 / 100
first audit · source
26841bf3d95f
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/clickhouse/clickhouse-js-node-rowbinary/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
canner/wrenai
Wren CLI for AI agents — a semantic SQL layer over 22+ databases (Postgres, MySQL, BigQuery, Snowflake, Spark, ...). The actual workflow guides live inside the `wren` CLI itself; this is just a discovery stub. Use…
wgzhao/Addax
Actively maintained successor to Alibaba DataX — a fast, versatile, open-source ETL tool for 20+ RDBMS and NoSQL data sources.
clickhouse/agent-skills
Sets up and manages ClickHouse using the clickhousectl CLI — installs and runs a local ClickHouse server for development, and creates managed ClickHouse Cloud services for production (authentication, service creation,…
clickhouse/agent-skills
Sets up and manages Postgres using the clickhousectl CLI — runs a local Docker-backed Postgres for development, and creates and operates managed ClickHouse Cloud Postgres services (connections, TLS, runtime config, read…
clickhouse/agent-skills
Troubleshoot and resolve common issues with the ClickHouse Node.js client (@clickhouse/client). Use this skill whenever a user reports errors, unexpected behavior, or configuration questions involving the Node.js client…
clickhouse/agent-skills
MUST USE when investigating performance issues on a ClickHouse-managed Postgres instance. Provides an evidence-based RCA workflow that scrapes the Prometheus endpoint for system signal, pulls per-digest evidence from…
Add this badge to your README
[](https://modelsatlas.com/skills/clickhouse/clickhouse-js-node-rowbinary/)
<a href="https://modelsatlas.com/skills/clickhouse/clickhouse-js-node-rowbinary/"><img src="https://modelsatlas.com/skills/clickhouse/clickhouse-js-node-rowbinary/badge.svg" alt="ModelsAtlas: SAFE B"></a>
Questions about clickhouse-js-node-rowbinary
What does the clickhouse-js-node-rowbinary skill do?
Is clickhouse-js-node-rowbinary safe to install?
What can clickhouse-js-node-rowbinary access on my machine?
Which assistants does clickhouse-js-node-rowbinary work with?
How current is this page?
Sources
- github.com/clickhouse/agent-skills/tree/main/skills/clickhouse-j — the audited source at commit 26841bf3d95f and every finding aboveObserved · 26 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the clickhouse-js-node-rowbinary skill do?
- Is clickhouse-js-node-rowbinary safe to install?
- What can clickhouse-js-node-rowbinary access on my machine?