clickhouse-js-node-rowbinary

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes database schema information to generate tailored RowBinary codecs.
  • Ingestion points: compileRowBinaryWithNamesAndTypes in src/readers/rowBinaryWithNamesAndTypes.ts reads ClickHouse type strings from a data stream.
  • Boundary markers: The reader uses explicit protocol-level lengths (LEB128) and fixed-width boundaries to isolate fields.
  • Capability inventory: The logic is confined to buffer manipulation and typed array population; no arbitrary code execution or filesystem access is exposed to the parsing logic.
  • Sanitization: Type strings are validated and parsed using a formal grammar parser (@clickhouse/datatype-parser) before being mapped to internal reader functions.
  • [EXTERNAL_DOWNLOADS]: The skill performs network requests to communicate with a ClickHouse database instance during testing.
  • Evidence: tests/clickhouse.ts uses the fetch API to query a ClickHouse server at a configurable URL (defaulting to localhost:8123) to verify that the generated codecs correctly handle server-produced bytes.
  • [DYNAMIC_EXECUTION]: Runtime compilation of WebAssembly is used in performance case studies.
  • Evidence: tests/wasm-int128.experiment.mjs uses WebAssembly.compile and WebAssembly.instantiate on static bytecode generated within the script to benchmark 128-bit integer math performance compared to JavaScript BigInt.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 03:54 AM