{
  "schemaVersion": 1,
  "evaluation": {
    "id": "duckdb-cli",
    "testedOn": "2026-10-18",
    "coverage": "local-runtime",
    "summary": "DuckDB summed the local CSV correctly, allowed arithmetic in safe mode, blocked CSV access in safe mode and rejected an INSERT into a read-only database.",
    "identity": {
      "version": "v1.5.6 (Variegata), commit 069cc9f9b5",
      "target": "https://github.com/duckdb/duckdb/releases/download/v1.5.6/duckdb_cli-windows-amd64.zip",
      "integrity": "SHA-256 798eae475d07c645ff3b914f7b0e676d06502b5412dd7552638fafed81f9e916 of the downloaded ZIP archive. Recorded to identify the tested artifact; no independent signature or provenance audit was performed."
    },
    "environment": [
      "Windows 11 x64; Python 3.12.10 harness. Raw timestamps use UTC.",
      "Fresh per-tool home, config, cache and temporary directories. Child environments used allowlisted OS/runtime paths without inherited account credentials. Only synthetic local files were used.",
      "Configuration isolation is a test control, not an operating-system sandbox."
    ],
    "checks": [
      {
        "id": "duckdb-cli-version",
        "name": "Pinned binary version",
        "method": "Command argument array: [\"duckdb\", \"--version\"].",
        "expected": "Print the version and commit.",
        "observed": "Exit 0. v1.5.6 (Variegata) 069cc9f9b5",
        "outcome": "pass"
      },
      {
        "id": "duckdb-cli-csv-sum",
        "name": "Aggregate a local CSV",
        "method": "Create sales.csv with exactly team,amount\\nA,12\\nB,5\\nA,8\\n (\\n denotes a newline). Command argument array: [\"duckdb\", \"-json\", \"-c\", \"SELECT team, sum(amount) AS total FROM read_csv('sales.csv') GROUP BY team ORDER BY team;\"].",
        "expected": "Return grouped totals of 20 for A and 5 for B.",
        "observed": "Exit 0. [{\"team\":\"A\",\"total\":\"20\"},\n{\"team\":\"B\",\"total\":\"5\"}]",
        "outcome": "pass"
      },
      {
        "id": "duckdb-cli-safe-sql",
        "name": "Allow arithmetic in safe mode",
        "method": "Command argument array: [\"duckdb\", \"-safe\", \"-json\", \"-c\", \"SELECT 2 + 3 AS total;\"].",
        "expected": "Return total 5.",
        "observed": "Exit 0. [{\"total\":5}]",
        "outcome": "pass"
      },
      {
        "id": "duckdb-cli-safe-file-block",
        "name": "Block CSV access in safe mode",
        "method": "Create sales.csv with exactly team,amount\\nA,12\\nB,5\\nA,8\\n (\\n denotes a newline). Command argument array: [\"duckdb\", \"-safe\", \"-json\", \"-c\", \"SELECT * FROM read_csv('sales.csv');\"].",
        "expected": "Reject external filesystem access.",
        "observed": "Exit 1. Permission Error: Cannot access file \"sales.csv\" - file system operations are disabled by configuration\n\nLINE 1: SELECT * FROM read_csv('sales.csv');\n                      ^",
        "outcome": "pass"
      },
      {
        "id": "duckdb-cli-create-db",
        "name": "Create a disposable database",
        "method": "Start with no fixture.duckdb file. Command argument array: [\"duckdb\", \"fixture.duckdb\", \"-c\", \"CREATE TABLE fixture AS SELECT 7 AS value;\"].",
        "expected": "Create a local table containing value 7.",
        "observed": "Exit 0. Created the disposable fixture.duckdb database; standard output and error were empty.",
        "outcome": "pass"
      },
      {
        "id": "duckdb-cli-readonly-block",
        "name": "Reject an INSERT into a read-only database",
        "method": "Use the fixture.duckdb created by CREATE TABLE fixture AS SELECT 7 AS value. Command argument array: [\"duckdb\", \"-readonly\", \"fixture.duckdb\", \"-c\", \"INSERT INTO fixture VALUES (8);\"].",
        "expected": "Reject the INSERT because the database is attached read-only.",
        "observed": "Exit 1. Invalid Input Error: Cannot execute statement of type \"INSERT\" on database \"fixture\" which is attached in read-only mode!",
        "outcome": "pass"
      }
    ],
    "findings": [
      {
        "title": "Safe mode blocked the tested external file read",
        "basis": "observed",
        "severity": "informational",
        "detail": "The ordinary query read sales.csv, while the same file function under -safe returned exit 1 because filesystem operations were disabled. A separate arithmetic query still returned 5.",
        "practicalAdvice": "Use safe mode when external access is unnecessary, and isolate untrusted SQL at the operating-system level as well."
      },
      {
        "title": "Read-only blocked the tested database write",
        "basis": "observed",
        "severity": "informational",
        "detail": "An INSERT into fixture.duckdb returned exit 1 when the file was opened with -readonly. This does not establish a general restriction on all files, extensions or network operations.",
        "practicalAdvice": "Use -readonly for database protection and review external-access controls separately."
      },
      {
        "title": "Extensions add executable capability",
        "basis": "documented",
        "severity": "medium",
        "detail": "DuckDB extensions can expand data access and run native code within the process. No extension installation or execution was tested.",
        "practicalAdvice": "Load only reviewed extensions and restrict process permissions and external access for untrusted workloads."
      }
    ],
    "caveats": [
      "The CSV aggregate output serialized totals as JSON strings \"20\" and \"5\" in this run; downstream consumers should check types.",
      "A small safe-mode and read-only probe does not establish a complete SQL sandbox or protection against malicious database files."
    ],
    "notTested": [
      "Extensions, remote storage, credentials, adversarial SQL or database files, and the full safe-mode boundary.",
      "Large datasets, performance, concurrency, database encryption and production access controls."
    ],
    "sources": [
      {
        "label": "DuckDB CLI overview",
        "url": "https://duckdb.org/docs/current/clients/cli/overview"
      },
      {
        "label": "CLI safe mode",
        "url": "https://duckdb.org/docs/current/clients/cli/safe_mode"
      },
      {
        "label": "Securing DuckDB",
        "url": "https://duckdb.org/docs/current/operations_manual/securing_duckdb/overview"
      },
      {
        "label": "DuckDB repository",
        "url": "https://github.com/duckdb/duckdb"
      },
      {
        "label": "MIT license",
        "url": "https://github.com/duckdb/duckdb/blob/main/LICENSE"
      }
    ],
    "reportUrl": "/interface-evaluations/duckdb-cli.json"
  }
}