·
Last changedVersion:
This version passed the hardening gate. Hardening applied 1 targeted change and preserved all other text. Classified findings before hardening: 7. Classified findings closed: 1. Classified findings remaining: 6. Unclassified scanner findings remaining: 0. Review findings closed: 0. Review findings remaining: 16.
5
2
5
1
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
reference/client-configuration.md | Sensitive Data & Secret Exposure | Hardcoded secret | Medium | Open | |
reference/select-formats.md | Memory & Context Poisoning | — | Medium | Open | |
reference/data-types.md | Excessive Agency & Rogue Autonomy | — | Medium | Open | |
SKILL.md | Prompt Injection | Direct prompt injection | Medium | Open | |
reference/select-formats.md | Prompt Injection | Direct prompt injection | Medium | Open | |
reference/client-configuration.md | Prompt Injection | Indirect prompt injection | Low | Open | |
reference/select-formats.md | Prompt Injection | Third-party content as instructions | Low | Closed |
7 findings
Reference: https://clickhouse.com/docs/integrations/javascript
@clickhouse/client (never @clickhouse/client-web)
and create a client with createClient({ url }) or rely on
supported defaults when appropriate. Close it with await client.close()
preferably when it's no longer needed or during graceful shutdown for global resources.JSONEachRow for typical row inserts/selects unless the user
has already chosen another format or is streaming raw bytes (CSV / TSV /
Parquet — see examples/node/performance/).
Note on clickhouse_settings: settings passed to createClient are
defaults for every request; they can be overridden per-call by passing
clickhouse_settings directly to insert(), query(), or command().
Always mention this when the user configures settings at the client level.query_params for user-supplied values — never template-
literal-interpolate them into SQL. See reference/query-parameters.md.
When answering a parameter-binding question, your response must
explicitly name template-literal interpolation as a "SQL injection
risk" — even when the user only asked about syntax and did not raise
security. The literal phrase "SQL injection" needs to appear; this is
the most common mistake from PostgreSQL/MySQL users and the security
framing is part of the correct answer, not an optional aside.client.insert() — write rows.client.query() + resultSet.json() / .text() / .stream() — read
rows that return data.client.command() — DDL and other statements that don't return rows
(CREATE, DROP, TRUNCATE, ALTER, SET in a session, etc.).client.exec() — when you need the raw response stream of an arbitrary
statement (rare in coding scenarios).client.ping() — health check; returns { success, error? }, never
throws on connection failure.pathname config option: client >= 1.0.0.BigInt values in query_params: client >= 1.15.0.TupleParam and JS Map in query_params: client >= 1.9.0.json.parse / json.stringify: client >= 1.14.0.Time / Time64 data types: ClickHouse server >= 25.6.QBit data type: ClickHouse server >= 25.10 (GA on 26.x).Dynamic / Variant / new JSON types: ClickHouse server >= 24.1 /
24.5 / 24.8 (no longer experimental since 25.3).Identify the user's task and read the matching reference file.
| Task | Triggers / symptoms | Reference file |
|---|---|---|
Configure / connect the client | Building a |
|
Compress requests / responses |
|
|
Ping the server | Health checks, readiness probes, "is ClickHouse up?" |
|
Choose an insert format | "Which format should I use to insert?", JSON vs raw, |
|
Insert into a subset of columns / different database |
|
|
Insert values, expressions, dates, decimals |
|
|
Async inserts (server-side batching) |
|
|
Select and parse results |
|
|
Parameterize queries | Binding values, special characters / escaping, "SQL injection?", |
|
Sessions & temporary tables |
|
|
Modern data types |
|
|
Custom JSON parse/stringify | Plug in |
|
import { createClient } from '@clickhouse/client' (Node, never
Web).await client.close() at the end of self-contained snippets; in
long-running services, close on graceful shutdown.format: 'JSONEachRow' and values: [...] unless the
user's scenario requires otherwise.await (await client.query({...})).json<RowType>() for
small / medium result sets; for bigger results suggest streaming.{name: Type}
syntax — never $1, ?, or :name.clickhouse_settings: { wait_end_of_query: 1 } on the command() call so
the server only acknowledges after the change is applied. See
https://clickhouse.com/docs/en/interfaces/http/#response-buffering.This skill covers day-to-day coding against @clickhouse/client (Node).
The following topics are intentionally not covered here:
ECONNRESET → use the
clickhouse-js-node-troubleshooting skill.examples/node/performance/.examples/node/security/.CREATE TABLE patterns, deployment-shaped connection strings,
replication / sharding choices — see
examples/node/schema-and-deployments/.@clickhouse/client-web and see
examples/web/.examples/node/coding/ — the runnable corpus this skill is built on.Get started with chainctlchainctl skill install public/clickhouse/clickhouse-js-node-coding:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/clickhouse/skills/clickhouse-js-node-coding:latest
Apache-2.0
HARDENING.md
LICENSE
SKILL.md
reference/async-insert.md
reference/client-configuration.md
reference/compression.md
reference/custom-json.md
reference/data-types.md
reference/insert-columns.md
reference/insert-formats.md
reference/insert-values.md
reference/ping.md
reference/query-parameters.md
reference/select-formats.md
reference/sessions.md