pp-clickhouse-cloud

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly shows shell commands that require placing API key/secret values verbatim (exporting CLICKHOUSE_CLOUD_PASSWORD and running auth set-token <key-id> <key-secret>), which would force an agent/LLM to handle or emit secrets directly.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill requires installing and running binaries fetched from remote Go modules (e.g., go install github.com/mvanhorn/printing-press-library/library/cloud/clickhouse-cloud/cmd/clickhouse-cloud-pp-cli@latest and github.com/mvanhorn/printing-press-library/library/cloud/clickhouse-cloud/cmd/clickhouse-cloud-pp-mcp@latest), which cause the runtime to fetch and execute remote code as a required dependency.