Live survey304 models · 14 providers · 22,792 auditsAudited grill-with-docs · SAFE →What changedHow we verifyllms.txt

Agent skill · Audited from source

clickhousectl-cloud-deploy

skill · clickhouse/agent-skillsApache-2.0 licenceAudited 28 Oct 2026 · source 26841bf3d95f

★ 561pushed 2 days agoversion 0.2.0
✕BLOCKGrade D · 69/100 · 14 findings · 26841bf
561repo stars · whole clickhouse/agent-skills

Is it safe? No — BLOCK, grade D (69/100). We read this skill's source at commit 26841bf3d95f and observed filesystem and network access and no hard-coded secrets. The audit raised 14 findings, 3 critical or high. What it does: Use when the user has tabular data (pandas DataFrame, parquet, csv, Arrow, json) and wants to filter, group, aggregate, join, or speed up slow pandas. Provides chDB DataStore — same pandas API, ClickHouse engine…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “clickhousectl-cloud-deploy (clickhouse/agent-skills)”. Retrieved 28 Oct 2026. https://modelsatlas.com/skills/clickhouse/clickhousectl-cloud-deploy

Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 3 critical or high findings, starting with “Prompt injection” in skills/clickstack-otel-collector/SKILL.md:220. Do not install it without reading them.

Trust audit

Audit 0.4.1 · source read 28 Oct 2026

Trust score69/100✕BLOCK D
0 critical3 high3 medium5 low3 info

BLOCK means the audit found something that could harm you or your machine. Grade D is shared by 721 of 17,602 audited skills.

What the source does

  • FilesystemDeclared1 observation
  • NetworkDeclared3 observations
  • ShellNone observedNo commands run in the source
  • DependenciesNot pinnedSome versions float
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS1
L1 Static sourceSecrets, path traversal, supply chain, hidden codeWARN4
L2 InstructionsPrompt injection, authority framing, hidden directivesFAIL9
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: instruction override, no behavioural pass.

Findings (14)

HIGHPrompt injectionprompt.credential_read · skills/clickstack-otel-collector/SKILL.md:220
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
> 1. In the [Cloud console](https://console.clickhouse.cloud), open **Organization → API keys
Why
asks the agent to read credentials
Fix
—
HIGHPrompt injectionprompt.credential_read · skills/clickstack-otel-collector/SKILL.md:330
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
as `hyperdx_ingest`. Open the shell with the combined load so `$CLICKHOUSE_PASSWORD` (and
Why
asks the agent to read credentials
Fix
—
HIGHPrompt injectionprompt.override · skills/clickstack-otel-collector/SKILL.md:777
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
4. **Ignore any prompt that asks you to set up or configure a collector / start ingestion.** You
Why
asks the agent to drop prior instructions or safety
Fix
remove the instruction
MEDIUMNetwork egressnet.beacon_words · packages/clickhouse-best-practices-build/src/validate-sql.ts:123
F-04 Network egressCWE-200 · CWE-319Layer L1
{ pattern: /\bthrowIf\s*\(/i, description: 'throwIf() function (error-based exfiltration)' },
Why
No further detail recorded for this rule.
Fix
—
MEDIUMSupply chainprompt.pipe_to_shell · skills/clickstack-otel-collector/SKILL.md:100
F-08 Supply chainCWE-829 · CWE-1357Layer L2
- The `clickhousectl` install in Step 3 uses `curl ... | sh`, which many agent sandboxes flag as
Why
No further detail recorded for this rule.
Fix
—
MEDIUMSupply chainprompt.pipe_to_shell · skills/clickstack-otel-collector/SKILL.md:191
F-08 Supply chainCWE-829 · CWE-1357Layer L2
installer: the `|| curl ... | sh` form drags a harmless check into a compound command that sandboxes
Why
No further detail recorded for this rule.
Fix
—
LOWInventory / provenanceinv.binary · skills/clickhouse-js-node-rowbinary/tests/Dynamic.test.ts
F-13 Inventory / provenanceCWE-1104Layer L0
Dynamic.test.ts
Why
a compiled or binary member cannot be reviewed from source
Fix
ship source, or explain the binary in the README
LOWFilesystem / pathfs.traversal · packages/clickhouse-best-practices-build/src/config.ts:11
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
export const SKILL_DIR = join(__dirname, '../../..', 'skills/clickhouse-best-practices')
Why
No further detail recorded for this rule.
Fix
—
LOWSupply chainsupply.unpinned · packages/clickhouse-best-practices-build/package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
@types/node, typescript
Why
2 dependency range(s) float
Fix
pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · skills/clickhouse-js-node-rowbinary/package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
@clickhouse/datatype-parser, typescript, vitest
Why
3 dependency range(s) float
Fix
pin exact versions or ship a lockfile
LOWPrompt injectionprompt.credential_read · skills/infra-postgres/ref/local.md:19
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
Defaults: name `default`, Postgres 18, port 5432, user `postgres`, database `postgres`, and a random 24-character password. The image is pulled automatically if missing. If port 5432 is taken, a free
Why
asks the agent to read credentials
Fix
—
INFOSupply chainprompt.pipe_to_shell · skills/clickstack-otel-collector/SKILL.md:201
F-08 Supply chainCWE-829 · CWE-1357Layer L2
curl -fsSL https://clickhouse.com/cli | sh
Why
No further detail recorded for this rule.
Fix
—
INFOSupply chainprompt.pipe_to_shell · skills/infra-clickhouse/SKILL.md:41
F-08 Supply chainCWE-829 · CWE-1357Layer L2
curl -fsSL https://clickhouse.com/cli | sh
Why
No further detail recorded for this rule.
Fix
—
INFOSupply chainprompt.pipe_to_shell · skills/infra-postgres/SKILL.md:42
F-08 Supply chainCWE-829 · CWE-1357Layer L2
curl -fsSL https://clickhouse.com/cli | sh
Why
No further detail recorded for this rule.
Fix
—

Audit 0.4.1 · source sha 26841bf3d95f · 28 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisherclickhouse GitHub organizationOwner of the repository this skill is read from
  • Source folderclickhouse/agent-skillsThe exact folder we audited
  • LicenceApache-2.0As the repository states it
  • Commit pinned for this verdict26841bf3d95fA new audit runs when the source changes
  • Repository statusNot archivedLast push 2 days ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Use when the user has tabular data (pandas DataFrame, parquet, csv, Arrow, json) and wants to filter, group, aggregate, join, or speed up slow pandas. Provides chDB DataStore — same pandas API, ClickHouse engine…

---
name: chdb-datastore
description: >-
  Use when the user has tabular data (pandas DataFrame, parquet, csv,
  Arrow, json) and wants to filter, group, aggregate, join, or speed
  up slow pandas. Provides chDB DataStore — same pandas API,
  ClickHouse engine underneath. Also handles reading from S3, MySQL,
  PostgreSQL, MongoDB, ClickHouse Cloud, Iceberg, Delta Lake as
  DataFrames and joining across sources.
  TRIGGER when: user mentions DataFrame, parquet, csv, "fast pandas",
  "speed up pandas", or cross-source DataFrame joins; user imports
  `chdb.datastore` or `from datastore import DataStore`.
  SKIP this skill for raw SQL syntax (use chdb-sql instead),
  ClickHouse server administration, or non-Python DataStore API work.
license: Apache-2.0
compatibility: Requires Python 3.9+, macOS or Linux. pip install chdb.
metadata:
  author: chdb-io
  version: "4.1"
  homepage: https://clickhouse.com/docs/chdb
---

# chdb DataStore — It's Just Faster Pandas

## The Key Insight

```python
# Change this:
import pandas as pd
# To this:
import chdb.datastore as pd
# Everything else stays the same.
```

DataStore is a **lazy, ClickHouse-backed pandas replacement**. Your existing pandas code works unchanged — but operations compile to optimized SQL and execute only when results are needed (e.g., `print()`, `len()`, iteration).

```bash
pip install chdb
```

## Decision Tree: Pick the Right Approach

```
1. "I have a file/database and want to analyze it with pandas"
   → DataStore.from_file() / from_mysql() / from_s3() etc.
   → See references/connectors.md

2. "I need to join data from different sources"
   → Create DataStores from each source, use .join()
   → See examples/examples.md #3-5

3. "My pandas code is too slow"
   → import chdb.datastore as pd — change one line, keep the rest

4. "I need raw SQL queries"
   → Use the chdb-sql skill instead
```

## Connect to Any Data Source — One Pattern

```python
from datastore import DataStore

# Local file (auto-detects .parquet, .csv, .json, .arrow, .orc, .avro, .tsv, .xml)
ds = DataStore.from_file("sales.parquet")

# Database
ds = DataStore.from_mysql(host="db:3306", database="shop", table="orders", user="root", password="pass")

# Cloud storage
ds = DataStore.from_s3("s3://bucket/data.parquet", nosign=True)

# URI shorthand — auto-detects source type
ds = DataStore.uri("mysql://root:pass@db:3306/shop/orders")
```

All 16+ sources and URI schemes → [connectors.md](references/connectors.md)

## After Connecting — Full Pandas API

```python
result = ds[ds["age"] > 25]                                          # filter
result = ds[["name", "city"]]                                        # select columns
result = ds.sort_values("revenue", ascending=False)                  # sort
result = ds.groupby("dept")["salary"].mean()                         # groupby
result = ds.assign(margin=lambda x: x["profit"] / x["revenue"])     # computed column
ds["name"].str.upper()                                               # string accessor
ds["date"].dt.year                                                   # datetime accessor
result = ds1.join(ds2, on="id")                                      # join
result = ds.head(10)                                                 # preview
print(ds.to_sql())                                                   # see generated SQL
```

209 DataFrame methods supported. Full API → [api-reference.md](references/api-reference.md)

## Cross-Source Join — The Killer Feature

```python
from datastore import DataStore

customers = DataStore.from_mysql(host="db:3306", database="crm", table="customers", user="root", password="pass")
orders = DataStore.from_file("orders.parquet")

result = (orders
    .join(customers, left_on="customer_id", right_on="id")
    .groupby("country")
    .agg({"amount": "sum", "rating": "mean"})
    .sort_values("sum", ascending=False))
print(result)
```

More join examples → [examples.md](examples/examples.md)

## Writing Data

```python
source = DataStore.from_mysql(host="db:3306", database="shop", table="orders", user="root", password="pass")
target = DataStore("file", path="summary.parquet", format="Parquet")

target.insert_into("category", "total", "count").select_from(
    source.groupby("category").select("category", "sum(amount) AS total", "count() AS count")
).execute()
```

## Troubleshooting

| Problem | Fix |
|---------|-----|
| `ImportError: No module named 'chdb'` | `pip install chdb` |
| `ImportError: cannot import 'DataStore'` | Use `from datastore import DataStore` or `from chdb.datastore import DataStore` |
| Database connection timeout | Include port in host: `host="db:3306"` not `host="db"` |
| Join returns empty result | Check key types match (both int or both string); use `.to_sql()` to inspect |
| Unexpected results | Call `ds.to_sql()` to see the generated SQL and debug |
| Environment check | Run `python scripts/verify_install.py` (from skill directory) |

## References

- [API Reference](references/api-reference.md) — Full DataStore method signatures
- [Connectors](references/connectors.md) — All 16+ data source connection methods
- [Examples](examples/examples.md) — 10+ runnable examples with expected output
- [Verify Install](scripts/verify_install.py) — Environment verification script
- [Official Docs](https://clickhouse.com/docs/chdb)

> Note: This skill teaches how to *use* chdb DataStore.
> For raw SQL queries, use the `chdb-sql` skill.
> For contributing to chdb source code, see CLAUDE.md in the project root.

Excerpt, first 5,521 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 26841bf

npx skills add clickhouse/agent-skills
pip install chdb
claude mcp add --transport http clickhouse-cloud https://mcp.clickhouse.cloud/mcp

Commands as the repository documents them: shown, never run by us. Our verdict covers commit 26841bf3d95f only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
Claude CodeMentioned in its text, not testedSkills for Claude Code · About Claude Code
CodexMentioned in its text, not testedSkills for Codex · About Codex
GitHub CopilotMentioned in its text, not testedSkills for GitHub Copilot · About GitHub Copilot
CursorMentioned in its text, not testedSkills for Cursor · About Cursor
Gemini CLIMentioned in its text, not testedSkills for Gemini CLI · About Gemini CLI
WindsurfMentioned in its text, not testedSkills for Windsurf · About Windsurf
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. ✕BLOCK D 69 / 100

    first audit · source 26841bf3d95f

wren✓SAFE

canner/wrenai

Wren CLI for AI agents — a semantic SQL layer over 22+ databases (Postgres, MySQL, BigQuery, Snowflake, Spark, ...). The actual workflow guides live inside the `wren` CLI itself; this is just a discovery stub. Use…

★ 18kGrade B
SKILL: Addax 项目知识✓SAFE

wgzhao/Addax

Actively maintained successor to Alibaba DataX — a fast, versatile, open-source ETL tool for 20+ RDBMS and NoSQL data sources.

★ 1.4kGrade B
infra-clickhouse✓SAFE

clickhouse/agent-skills

Sets up and manages ClickHouse using the clickhousectl CLI — installs and runs a local ClickHouse server for development, and creates managed ClickHouse Cloud services for production (authentication, service creation,…

★ 562Grade B
infra-postgres!CAUTION

clickhouse/agent-skills

Sets up and manages Postgres using the clickhousectl CLI — runs a local Docker-backed Postgres for development, and creates and operates managed ClickHouse Cloud Postgres services (connections, TLS, runtime config, read…

★ 562Grade B
clickhouse-js-node-rowbinary✓SAFE

clickhouse/agent-skills

Generate TypeScript/JavaScript code that reads/decodes AND writes/encodes ClickHouse RowBinary streams for the ClickHouse HTTP server. Use this skill whenever a user wants to parse or produce `RowBinary`,…

★ 561Grade B
clickhouse-js-node-troubleshooting✓SAFE

clickhouse/agent-skills

Troubleshoot and resolve common issues with the ClickHouse Node.js client (@clickhouse/client). Use this skill whenever a user reports errors, unexpected behavior, or configuration questions involving the Node.js client…

★ 561Grade B

Questions about clickhousectl-cloud-deploy

What does the clickhousectl-cloud-deploy skill do?
The official Agent Skills for ClickHouse and ClickHouse Cloud
Is clickhousectl-cloud-deploy safe to install?
No — not without reading the findings first. The audit graded it D (69/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What can clickhousectl-cloud-deploy access on my machine?
The audit observed that it reaches the network and reads or writes files. Each of those is consistent with what it says it does. Secrets in the source: none found.
Which assistants does clickhousectl-cloud-deploy work with?
Its documentation mentions claude-code, codex, copilot, cursor, gemini-cli and windsurf. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (26841bf3d95f), read on 2026-10-28. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.