clickhousectl-cloud-deploy
The skill executes arbitrary remote code and insecurely manages sensitive credentials while bypassing security constraints by failing to declare its network and file system tool permissions.
Skill Info
Install
npx skills add https://github.com/clickhouse/agent-skillsAssessments (3)
AI Agent Traps ↗Remote code download and execution detected
curl -fsSL https://clickhouse.com/cli | sh
The skill instructs the agent to write sensitive database credentials (including generated passwords) into a local .env file, which may be inadvertently committed to version control or exposed to other processes.
echo "CLICKHOUSE_USER=app_user" >> .env echo "CLICKHOUSE_PASSWORD=$PASSWORD" >> .env
The skill encourages insecure credential management practices by instructing users to append sensitive database passwords directly to a local `.env` file using shell commands.
Step 6: 'echo "CLICKHOUSE_PASSWORD=$PASSWORD" >> .env'
Badge
[](https://mondoo.com/ai-agent-security/skills/github/clickhouse/agent-skills/clickhousectl-cloud-deploy)<a href="https://mondoo.com/ai-agent-security/skills/github/clickhouse/agent-skills/clickhousectl-cloud-deploy"><img src="https://mondoo.com/ai-agent-security/api/badge/github/clickhouse/agent-skills/clickhousectl-cloud-deploy.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/clickhouse/agent-skills/clickhousectl-cloud-deploy.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet, discover and control Shadow AI usage.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow