clickhouse-incident-runbook
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
curlto check local service health (localhost:8123) andsystemctl/dockercommands to restart services during recovery. These are standard administrative actions for an on-call runbook. - [EXTERNAL_DOWNLOADS]: Fetches status information from
status.clickhouse.cloud, which is a well-known service for this technology. - [DATA_EXFILTRATION]: Includes instructions to export query logs to
/tmp/incident-queries.jsonfor forensic analysis. This is a local file operation for troubleshooting and does not involve sending data to an external attacker-controlled server.
Audit Metadata