clickhouse-enterprise-rbac

A model-agnostic agent-skills platform.

审核状态：已审核Quality 72Security 78

复制安装命令

用 Codex 或 Claude 安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它先审查 Skill 页面再帮你安装。

复制前请先查看来源、License 和安全提示。

项目 README

来源文件：README.md

抓取于 2026年8月28日

Tons of Skills

A model-agnostic agent-skills platform. The canonical layer is harness-free by construction; Claude Code is currently the verified-native harness. Other harnesses remain engineering candidates until their native-path integration is verified; source research alone is never presented as public support.

Version semantics: the release badge is this marketplace's display version. npm packages, including the ccpi CLI and publishable plugins, retain their own package versions; they are intentionally not expected to equal the display version. The version-surface checker governs the display surfaces without rewriting package semver.

Install

Inside Claude Code, one command installs the whole marketplace:

/plugin marketplace add jeremylongshore/claude-code-plugins

Or use the CLI:

pnpm add -g @intentsolutionsio/ccpi
ccpi install devops-automation-pack

Browse the marketplace · Explore plugins · Download bundles

Killer Skill of the Week — no-ai-slop by Peter Yang

Strip AI slop from any draft — named-pattern edits that keep the writer's real voice

no-ai-slop does two jobs and refuses to fake a third. In Edit mode it makes the minimum effective edit — cutting throat-clearing, weak verbs, and abstract nouns while deliberately preserving the writer's cadence, bluntness, humor, and honest admissions, so a rough draft still sounds like the same person afterward. In Detect mode it names each AI-slop pattern it finds, quotes the offending line, and gives the fix in a few words — and pointedly does NOT score the draft or guess whether an AI wrote it. That restraint is the whole point: AI detectors guess; named patterns are evidence the reader can check. MIT-licensed, single focused skill, actively maintained by Peter Yang.

"AI detectors guess. Named patterns are evidence the user can check." — Peter Yang

Grade: A | Week of July 22, 2026 (W30) | View on GitHub

Previous picks: tonone, mnemos, databricks-pack, kobiton-automate, skyvern, code-cleanup, web-analytics, token-optimizer, executive-assistant-skills, skill-creator, cursor-pack, crypto-portfolio-tracker. See all at tonsofskills.com.

Scale, labeled

Every number below names the cohort it counts and the command that reproduces it — an unlabeled count is how a corpus ends up with five contradictory answers to "how many skills."

Count	Cohort	Reproduce with
442	catalog plugins (catalog-entry cohort)	`node scripts/generate-readme-toc.mjs` over `marketplace.extended.json`
3,067	marketplace-visible skills (distinct)	`node -e "import('./scripts/corpus-resolver.mjs').then(m=>console.log(m.resolveCorpus('marketplace-visible').length))"`
347	agent definitions in plugins	`git ls-files 'plugins/*' \| grep '/agents/.\.md'`
19	plugin categories	`ls -d plugins/*/`

📦 Live npm Downloads

Across 396 published packages in the claude-code-plugins namespace. Updated daily by GitHub Actions.

Window	All packages	Established (>30d)
Last 24 hours	962	962
Last 7 days	2,920	2,916
Last 30 days	12,868	12,779

_{"Established" excludes packages first published within the last 30 days, so a bulk-publish event doesn't dominate the headline.}

Top 10 by last 30 days:

#	Package	Last 30d
1	`@intentsolutionsio/openrouter-pack`	556
2	`@intentsolutionsio/groq-pack`	496
3	`@intentsolutionsio/databricks-pack`	274
4	`@intentsolutionsio/clickhouse-pack`	273
5	`@intentsolutionsio/wallet-security-auditor`	263
6	`@intentsolutionsio/notion-pack`	258
7	`@intentsolutionsio/elevenlabs-pack`	244
8	`@intentsolutionsio/freshie-inventory-manager`	214
9	`@intentsolutionsio/supabase-pack`	210
10	`@intentsolutionsio/agency-os`	204

_{Last refreshed 2026-08-19T03:03:05.709Z.}

Ways in

Five real questions, five doors — each resolves to a live, generated surface, never a hand-maintained list:

By category — the table below, regenerated from the catalog on every sync.
By plugin — tonsofskills.com/explore, the full browsable catalog.
By skill — tonsofskills.com/skills, searchable across the whole corpus.
By job to be done — tonsofskills.com/cowork, curated bundles as one-click downloads.
By certification tier — the Certification section below, rendered from the live report.

Browse by category

The 19 categories below link into the live marketplace. Plugin counts are the catalog-entry cohort — regenerated from marketplace.extended.json by this generator; the catalog itself lives on tonsofskills.com, never in this file (§ 6A of the platform blueprint).

	Category	Plugins
🤖	AI & Machine Learning	36
🎭	AI Agents & Agency	10
🔌	API Development	26
💼	Business Tools	6
👥	Community	21
₿	Crypto & Web3	27
💾	Database	26
🎨	Design	2
🔧	DevOps & Infrastructure	36
📚	Examples & Templates	5
🧩	MCP Servers	16
📦	Packages	5
⚡	Performance	25
✅	Productivity	30
🎁	SaaS Skill Packs	106
🔐	Security	27
✨	Skill Enhancers	9
🧪	Testing	28
📁	Analytics	1

What the classes mean

Four artifact classes live in this repository, distinguished on sight and never blurred — provenance is a truth requirement here, not a UX nicety:

Class	What it is	How the reader can tell
Canonical skill	First-party, harness-free, the source of truth	No `.source.json` in its plugin directory
Generated adapter	A thin, machine-produced harness projection	Lives under a generated path with a "generated — do not edit" header
First-party package	An Intent Solutions distribution (npm, cowork zip)	`@intentsolutionsio` scope, IS-authored license
Upstream mirror	Somebody else's work, hosted mirror-by-default	`.source.json` present — upstream author, license, and pinned commit recorded

Certification

Not yet certified. The certification program (tiers T0–T4 with retained, hash-matched evidence) is a later epic of the platform blueprint; until its report exists, no artifact on this surface claims a tier. This line is rendered from the absence of certification-report.json — honestly, not cosmetically.

Contribute

Start with the contribution guide, then the intake and review standards every submission passes through:

Contribution requirements — including the AI-assistance disclosure expectation.
Skill submission intake standard — the tiered document matrix new plugins ship with.
External-PR review standard — how maintainers triage and what gets a submission merged.

Governance

STANDARDS.md — the public spec posture and the canonical-documents index (one owner per fact class).
The platform master blueprint — CI gates, release, docs governance, and this README's own landing contract.
GOVERNANCE.md · SECURITY.md · LICENSE

Provenance

External plugins are hosted mirror-by-default: the contributor's repository stays the source of truth, every mirrored source is pinned in a content lockfile, and upstream credit — author, license, resolved commit — is recorded in the mirror itself. Improvements flow by upstreaming to the author's repository, never by silently editing the mirror. The full decision record is the external-sync model.

License

MIT for the repository scaffolding and first-party tooling; each plugin carries its own license in its manifest, and mirrored plugins keep their upstream license verbatim.

其他

中风险

来源需自行核对维护者身份。
未检测到明显脚本安装指令。
可能需要外部 token、网络权限或第三方服务。
未检测到高风险命令。
扫描发现：1 条。

Codex — Git Clone 安装

安装前请先查看来源仓库和风险报告。
克隆仓库：git clone https://github.com/jeremylongshore/tons-of-skills-marketplace.git
将 "skills/.curated/clickhouse-enterprise-rbac" 文件夹复制到 Codex 的 skills 目录中。
重启 Codex 让新的 skill 生效。

Codex — 手动复制安装

安装前请先查看来源仓库和风险报告。
从源仓库下载 SKILL.md 及相关文件。
在 Codex 的 skills 目录中创建新文件夹。
将所有 skill 文件复制到新文件夹中。
重启 Codex 让新的 skill 生效。

Claude Code — Git Clone 安装

安装前请先查看来源仓库和风险报告。
克隆仓库：git clone https://github.com/jeremylongshore/tons-of-skills-marketplace.git
将 "skills/.curated/clickhouse-enterprise-rbac" 文件夹复制到 Claude Code 的 skills 目录中。
重启 Claude Code 让新的 skill 生效。

Claude Code — 手动复制安装

安装前请先查看来源仓库和风险报告。
从源仓库下载 SKILL.md 及相关文件。
在 Claude Code 的 skills 目录中创建新文件夹。
将所有 skill 文件复制到新文件夹中。
重启 Claude Code 让新的 skill 生效。

Cursor — Git Clone 安装

安装前请先查看来源仓库和风险报告。
克隆仓库：git clone https://github.com/jeremylongshore/tons-of-skills-marketplace.git
将 "skills/.curated/clickhouse-enterprise-rbac" 文件夹复制到 Cursor 的 skills 目录中。
重启 Cursor 让新的 skill 生效。

Cursor — 手动复制安装

安装前请先查看来源仓库和风险报告。
从源仓库下载 SKILL.md 及相关文件。
在 Cursor 的 skills 目录中创建新文件夹。
将所有 skill 文件复制到新文件夹中。
重启 Cursor 让新的 skill 生效。

GitHub Copilot — Git Clone 安装

安装前请先查看来源仓库和风险报告。
克隆仓库：git clone https://github.com/jeremylongshore/tons-of-skills-marketplace.git
将 "skills/.curated/clickhouse-enterprise-rbac" 文件夹复制到 GitHub Copilot 的 skills 目录中。
重启 GitHub Copilot 让新的 skill 生效。

GitHub Copilot — 手动复制安装

安装前请先查看来源仓库和风险报告。
从源仓库下载 SKILL.md 及相关文件。
在 GitHub Copilot 的 skills 目录中创建新文件夹。
将所有 skill 文件复制到新文件夹中。
重启 GitHub Copilot 让新的 skill 生效。

Windsurf — Git Clone 安装

安装前请先查看来源仓库和风险报告。
克隆仓库：git clone https://github.com/jeremylongshore/tons-of-skills-marketplace.git
将 "skills/.curated/clickhouse-enterprise-rbac" 文件夹复制到 Windsurf 的 skills 目录中。
重启 Windsurf 让新的 skill 生效。

Windsurf — 手动复制安装

安装前请先查看来源仓库和风险报告。
从源仓库下载 SKILL.md 及相关文件。
在 Windsurf 的 skills 目录中创建新文件夹。
将所有 skill 文件复制到新文件夹中。
重启 Windsurf 让新的 skill 生效。

查看 SKILL.md 原文

name: clickhouse-enterprise-rbac
description: |
  Configure ClickHouse enterprise RBAC — SQL-based users, roles, row policies,
  column-level grants, and quota management.
  Use when setting up multi-user access control, implementing tenant isolation,
  or configuring enterprise security for ClickHouse.
  Trigger with "clickhouse RBAC", "clickhouse roles", "clickhouse permissions",
  "clickhouse row policy", "clickhouse enterprise access", "clickhouse GRANT".
allowed-tools: Read, Write
version: 1.7.0
license: MIT
author: Jeremy Longshore <jeremy@intentsolutions.io>
tags:
- saas
- database
- analytics
- clickhouse
- olap
compatibility: Designed for Claude Code

ClickHouse Enterprise RBAC

Overview

Implement enterprise-grade role-based access control in ClickHouse using SQL-based user management, hierarchical roles, row-level policies, column grants, quotas, and settings profiles. The workflow builds least-privilege access from the ground up: create authenticated users, compose reusable roles, then narrow visibility with row and column policies and cap resource use with quotas.

Follow the seven steps below at a high level from this file; drill into the full implementation for every SQL statement, and worked examples for two end-to-end scenarios plus audit queries.

Prerequisites

ClickHouse with access_management = 1 enabled (default in Cloud)
Admin user with GRANT OPTION

Instructions

The build-out is seven steps. Steps 1–3 (users, roles, row security) carry the core skeleton here; Steps 4–7 (column grants, quotas, settings profiles, and the application wrapper) are summarized here and fully specified in references/implementation.md.

Step 1: Create Users with Authentication

Pick an authentication method per user: sha256_password (standard), double_sha1_password (MySQL wire protocol), or bcrypt_password (strongest — use for admin accounts). Restrict network reach with HOST IP and cap per-user resources inline with SETTINGS.

CREATE USER app_backend
    IDENTIFIED WITH sha256_password BY 'strong-password-here'
    DEFAULT DATABASE analytics
    HOST IP '10.0.0.0/8'           -- Restrict to VPC
    SETTINGS max_memory_usage = 10000000000,   -- 10GB per query
             max_execution_time = 60;          -- 60s timeout

SHOW CREATE USER app_backend;      -- Verify

Step 2: Create Role Hierarchy

Build leaf-level base roles (data_reader, data_writer, schema_manager), then compose them into job roles (analyst, developer, platform_admin). Grant roles to users and set a default role that activates on connect.

CREATE ROLE data_reader;
GRANT SELECT ON analytics.* TO data_reader;

CREATE ROLE analyst;
GRANT data_reader TO analyst;      -- Composite inherits base

GRANT analyst TO app_backend;
SET DEFAULT ROLE analyst TO app_backend;
SHOW GRANTS FOR app_backend;       -- Verify the full chain

Step 3: Row-Level Security

Isolate multi-tenant data with row policies — each user sees only rows matching its USING predicate. A permissive USING 1 = 1 policy lets an admin role see everything.

CREATE ROW POLICY acme_isolation ON analytics.events
    FOR SELECT
    USING tenant_id = 1
    TO tenant_acme;

SELECT * FROM system.row_policies;  -- List all policies

Steps 4–7: Column Grants, Quotas, Profiles, App Wrapper

Step 4 — Column-level grants: GRANT SELECT(col, ...) to hide PII columns and GRANT INSERT(col, ...) to prevent metadata injection.
Step 5 — Quotas: cap queries, read_rows, result_rows, and execution_time per interval so one user cannot exhaust the cluster.
Step 6 — Settings profiles: enforce readonly, memory, thread, and concurrency ceilings; a separate ETL profile enables async_insert.
Step 7 — Application wrapper: a per-role client factory in the app layer so read, write, and admin operations use distinct ClickHouse users.

Full SQL and the TypeScript wrapper: references/implementation.md.

Output

Running this workflow produces, in the target ClickHouse instance:

Users with scoped authentication, network restrictions, and per-user resource caps.
A role hierarchy — base roles composed into job roles, assigned as default roles.
Row policies enforcing tenant/row isolation, visible in system.row_policies.
Column grants hiding PII, verifiable via SHOW GRANTS FOR <role>.
Quotas and settings profiles bounding resource use per user/role.

Verify the deployment with SHOW ACCESS, SHOW GRANTS FOR <user>, and the audit queries in references/examples.md.

Error Handling

Error Code	Name	Solution
497	ACCESS_DENIED	`SHOW GRANTS FOR user`, add missing GRANT
516	AUTHENTICATION_FAILED	Verify password, check HOST restriction
164	READONLY	User has `readonly=1`, grant write if needed
497	Not enough privileges to execute GRANT	Use admin user with GRANT OPTION

Examples

Two end-to-end scenarios — a multi-tenant SaaS isolation setup and a PII-safe analyst role — plus the access-control audit queries live in references/examples.md. The core of Example 1:

-- Each tenant reads only its own rows from a shared table
CREATE ROW POLICY acme_isolation   ON analytics.events FOR SELECT USING tenant_id = 1 TO tenant_acme;
CREATE ROW POLICY globex_isolation ON analytics.events FOR SELECT USING tenant_id = 2 TO tenant_globex;
-- Connected as tenant_acme, this returns ONLY tenant_id = 1:
SELECT tenant_id, count() FROM analytics.events GROUP BY tenant_id;

Resources

Next Steps

For schema migrations, see the clickhouse-migration-deep-dive skill in this pack.

发现问题？提交给管理员复核

暂无评论，成为第一个评论者吧！