clickhouse-js-node-rowbinary
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes database schema information to generate tailored RowBinary codecs.
- Ingestion points:
compileRowBinaryWithNamesAndTypesinsrc/readers/rowBinaryWithNamesAndTypes.tsreads ClickHouse type strings from a data stream. - Boundary markers: The reader uses explicit protocol-level lengths (LEB128) and fixed-width boundaries to isolate fields.
- Capability inventory: The logic is confined to buffer manipulation and typed array population; no arbitrary code execution or filesystem access is exposed to the parsing logic.
- Sanitization: Type strings are validated and parsed using a formal grammar parser (
@clickhouse/datatype-parser) before being mapped to internal reader functions. - [EXTERNAL_DOWNLOADS]: The skill performs network requests to communicate with a ClickHouse database instance during testing.
- Evidence:
tests/clickhouse.tsuses thefetchAPI to query a ClickHouse server at a configurable URL (defaulting tolocalhost:8123) to verify that the generated codecs correctly handle server-produced bytes. - [DYNAMIC_EXECUTION]: Runtime compilation of WebAssembly is used in performance case studies.
- Evidence:
tests/wasm-int128.experiment.mjsusesWebAssembly.compileandWebAssembly.instantiateon static bytecode generated within the script to benchmark 128-bit integer math performance compared to JavaScript BigInt.
Audit Metadata