Skip to content

docs: update official Cloud skill links and security guidance #3595

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bohutang merged 2 commits into from
Nov 5, 2026
Merged

docs: update official Cloud skill links and security guidance #3595

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1941a65
docs: update official Cloud skill links and security guidance
bohutang Nov 5, 2026
ff26496
docs: remove redundant official skill note
bohutang Nov 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 9 additions & 10 deletions docs/cn/guides/35-connect/03-agent-skills.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,16 +25,12 @@ description: 安装 Databend Cloud skill，让 Agent 协助您查询数据、管

```text
请安装以下 databend-cloud skill。
https://github.com/evotai/evot-skills/tree/main/skills/databend-cloud
https://github.com/databendcloud/databend-cloud-skill

按 SKILL.md 为 https://api.databend.cn 复用已有 API key，缺少时引导我保存。
不要在聊天中索取 key。配置完成即停止，不连接数据库或执行 SQL。
```

:::note
这是 Databend 官方提供的 skill，非第三方项目。
:::

## 快速验证

运行以下命令，确认 token、组织和计算集群配置正确。请将占位符替换为实际值。
Expand All @@ -50,9 +46,12 @@ curl --request POST 'https://api.databend.cn/v1/query' \

## 安全须知

- 请勿在聊天中发送 token，也不要将其提交到代码仓库。本地凭证以明文保存，辅助脚本会将文件的 Unix 权限设为 `600`。
- 请按需授予账号权限。Token 可访问该账号获准使用的组织，skill 本身不限制写操作。如需只读访问，请通过数据库权限控制。
- Agent 可能将查询结果和日志提交给模型处理，请遵循组织的数据安全要求。
- 如需撤销 token，请在 Cloud 控制台将其禁用或删除。替换本地密钥文件不会使旧 token 失效。
- 为 Token 设置 IP 白名单，拒绝名单外的访问。白名单为空时不限制 IP。
- 请添加 Agent 实际运行环境的出口 IP。远程 Agent 的出口 IP 可能与你的本地电脑不同。
- Token 遵循账号当前的组织角色权限；只读访问需通过数据库权限控制。Skill 本身不提供只读沙箱。
- 可在 Cloud 控制台禁用或删除 Token，以撤销访问权限。替换本地密钥文件不会使旧 Token 失效。
- 可在 Cloud 控制台查看 Token 最近使用的 IP 和时间，但这不代表完整的请求审计记录。
- 请勿将 Token 放入聊天、代码或代码仓库。本地凭证以明文保存，辅助脚本会将文件的 Unix 权限设为 `600`。
- 查询结果和日志可能进入 Agent 的模型上下文，请遵循组织的数据安全要求。

更多说明请参阅[身份认证](https://raw.githubusercontent.com/evotai/evot-skills/main/skills/databend-cloud/references/authentication.md)和 [Query API 参考](https://raw.githubusercontent.com/evotai/evot-skills/main/skills/databend-cloud/references/query-api.md)。
更多说明请参阅[身份认证](https://raw.githubusercontent.com/databendcloud/databend-cloud-skill/main/references/authentication.md)和 [Query API 参考](https://raw.githubusercontent.com/databendcloud/databend-cloud-skill/main/references/query-api.md)。
17 changes: 8 additions & 9 deletions docs/en/guides/35-connect/03-agent-skills.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,16 +25,12 @@ Copy this message to install the skill and set up a reusable API key. Create a t

```text
Install the databend-cloud skill:
https://github.com/evotai/evot-skills/tree/main/skills/databend-cloud
https://github.com/databendcloud/databend-cloud-skill

Follow SKILL.md to reuse an API key or help me save one for https://api.databend.com.
Keep the key out of chat. Stop after setup; do not connect or run SQL.
```

:::note
This is an official Databend skill, not a third-party skill.
:::

## Quick Verification

Run this command to make sure that your token, organization, and warehouse are correct. Replace the placeholders with your values.
Expand All @@ -50,9 +46,12 @@ curl --request POST 'https://api.databend.com/v1/query' \

## Security

- Keep tokens out of chat and repositories. Local credential files are plaintext; the helper sets Unix permissions to `600`.
- Use least-privilege accounts. Tokens follow the account's org permissions. The skill is not a read-only sandbox; database privileges enforce read-only access.
- Set a token IP allowlist to reject requests from other IPs. An empty allowlist means no IP restriction.
- Allow the actual outbound IP of the agent's execution environment. A remote agent can use a different outbound IP from your local computer.
- Tokens follow your account's current organization role. Use database permissions for read-only access. The skill is not a read-only sandbox.
- Disable or delete tokens in the Cloud console to revoke access. Replacing a local key file does not revoke the old token.
- View the token's last-used IP and time in the Cloud console. This is not a complete request audit log.
- Keep tokens out of chat, code, and repositories. Local credential files are plaintext; the helper sets Unix permissions to `600`.
- Results and logs can enter the agent's model context. Follow your data policy.
- Revoke tokens in the Cloud console. Replacing a local key file does not revoke the old token.

Details: [Authentication](https://raw.githubusercontent.com/evotai/evot-skills/main/skills/databend-cloud/references/authentication.md) · [Query API](https://raw.githubusercontent.com/evotai/evot-skills/main/skills/databend-cloud/references/query-api.md).
Details: [Authentication](https://raw.githubusercontent.com/databendcloud/databend-cloud-skill/main/references/authentication.md) · [Query API](https://raw.githubusercontent.com/databendcloud/databend-cloud-skill/main/references/query-api.md).
Loading