ClawHub
Back to skill

Security audit

Redis

Security checks for vulnerabilities and agentic risk

Overview

This Redis skill is a coherent operations guide with disclosed local preference storage and destructive-command safeguards, though users should be careful with live Redis access and bulk delete examples.

Before installing, be aware that this skill may use redis-cli guidance for live Redis diagnostics and may store Redis-related preferences or observed context locally. Review commands before running them on production, especially SCAN plus UNLINK, FLUSH, CONFIG SET, SHUTDOWN, failover, or script-cache commands.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Rogue AgentSelf-Modification, Session Persistence
Findings (13)

Unbounded Output

Medium
Category
Output Handling
Confidence
60% confidence
Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

md
| `MULTI`/`EXEC` used as a transaction with rollback | Runtime errors leave earlier commands applied; there is no rollback | Lua for all-or-nothing (→ `scripting.md`) |
| Storing a JSON blob and updating one field | Read-modify-write over the network loses concurrent updates and re-serializes the whole document | Hash fields, or the JSON module for partial updates (→ `modules.md`) |
| Pub/Sub for work that must not be lost | At-most-once, no persistence, no acks: a disconnected subscriber misses everything | Streams with a consumer group (→ `queues.md`) |
| `XACK` without trimming | Acking removes the entry from the pending list, not from the stream; memory grows unbounded | `XADD ... MAXLEN ~ N` or a periodic `XTRIM MINID` (→ `queues.md`) |
| Releasing a lock with `DEL key` | After a TTL expiry you delete the *next* holder's lock | Lua compare-and-delete on the token (→ `locks.md`) |
| Expiry events used as a reliable trigger | Keyspace notifications are Pub/Sub: fire-and-forget, and the event fires when the key is actually deleted, not at the TTL instant | A sorted set of due timestamps polled by a worker (→ `keys-ttl.md`) |
| `CONFIG SET` without `CONFIG REWRITE` | The change disappears on the next restart, usually during the next incident | Rewrite the config file, or change it in the provider's parameter group |

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The example redis-cli --scan --pattern 'app:tmp:*' | xargs -L 500 redis-cli UNLINK performs bulk deletion and is presented in the 'Walking The Keyspace Safely' section without an inline warning on the command itself. Even though UNLINK is safer than DEL and the document later discusses dangerous commands, this one-liner can still delete large sets of production data if copied blindly or if the pattern is broader than intended.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · cli.md (reported line 34)May include surrounding context.

md
## Encodings: Small Collections Are Not Hash Tables

Below a size threshold Redis stores a collection as a **listpack** (a flat, contiguous byte array) instead of a real hash table or skiplist — a fraction of the memory, O(N) operations that are fast because N is tiny. Cross the threshold once and the conversion is permanent for that key, even if it shrinks again.

| Type | Packed while | Config (Redis >=7.0 names) |
|---|---|---|

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · data-types.md (reported line 7)May include surrounding context.

md
## Encodings: Small Collections Are Not Hash Tables

Below a size threshold Redis stores a collection as a **listpack** (a flat, contiguous byte array) instead of a real hash table or skiplist — a fraction of the memory, O(N) operations that are fast because N is tiny. Cross the threshold once and the conversion is permanent for that key, even if it shrinks again.

| Type | Packed while | Config (Redis >=7.0 names) |
|---|---|---|

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · data-types.md (reported line 17)May include surrounding context.

md
## Encodings: Small Collections Are Not Hash Tables

Below a size threshold Redis stores a collection as a **listpack** (a flat, contiguous byte array) instead of a real hash table or skiplist — a fraction of the memory, O(N) operations that are fast because N is tiny. Cross the threshold once and the conversion is permanent for that key, even if it shrinks again.

| Type | Packed while | Config (Redis >=7.0 names) |
|---|---|---|

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · migrations.md (reported line 9)May include surrounding context.

md
## Encodings: Small Collections Are Not Hash Tables

Below a size threshold Redis stores a collection as a **listpack** (a flat, contiguous byte array) instead of a real hash table or skiplist — a fraction of the memory, O(N) operations that are fast because N is tiny. Cross the threshold once and the conversion is permanent for that key, even if it shrinks again.

| Type | Packed while | Config (Redis >=7.0 names) |
|---|---|---|

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown includes a ready-to-run command that unlinks many Redis keys matching a pattern, which can remove user or application data at scale. Although the section says 'safely' in an operational sense, it does not explicitly warn that the command is destructive or advise users to verify the pattern and target environment before running it.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · memory-eviction.md (reported line 29)May include surrounding context.

md
- The replication backlog (`repl-backlog-size`, default 1mb, sized for the expected reconnect window)
- The AOF buffer between fsyncs, and the rewrite buffer during a rewrite

Managed providers reserve this for you and expose it as a percentage (ElastiCache's `reserved-memory-percent` defaults to 25) — do not add your own reservation on top without checking.

## When Redis Is Full

Unbounded Output

Medium
Category
Output Handling
Confidence
60% confidence
Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · queues.md (reported line 38)May include surrounding context.

md
## Trimming Is Not Optional

`XACK` removes an entry from the group's pending list. It does **not** remove it from the stream. Without trimming, the stream is an unbounded log in RAM.

- `XADD key MAXLEN ~ 100000 *` — the `~` trims at radix-node boundaries, so it is cheap and approximate; exact `MAXLEN 100000` costs more per write.
- `XTRIM key MINID ~ <ms-timestamp>` when retention is a time window rather than a count.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs the agent to read from and write to user-local files containing preferences and prior context without any notice, consent, or minimization guidance. That creates a privacy and data-handling risk because potentially sensitive operational details can be silently persisted across sessions and later reused or exposed in unintended contexts.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
84% confidence
Finding

The skill encourages the agent to inspect a live Redis instance and infer configuration details 'without asking,' then record them to memory. In a security-sensitive infrastructure context, autonomous environment interrogation and persistence of observed state can exceed user intent, expand access to production metadata, and normalize actions against live systems without explicit approval.

Content

Scanner excerpt · setup.md (reported line 26)May include surrounding context.

md
- `INFO replication` → `role`, connected replicas, whether this is a replica at all
- `INFO memory` → `maxmemory`, `maxmemory_policy`, `used_memory`, `mem_fragmentation_ratio`
- `INFO persistence` → `aof_enabled`, `rdb_last_bgsave_status`, `loading`
- `CLUSTER INFO` → `cluster_enabled:1` settles `topology` without asking

Record what these reveal in `~/Clawic/data/redis-store/memory.md`, not in `config.yaml` — observed state is not a declared preference.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This section explicitly directs persistent recording of user preferences, habits, restrictions, incidents, and prior context into local memory files, again without an explicit persistence warning. Even if framed as convenience, it can accumulate sensitive infrastructure and behavioral information that may later influence actions or be disclosed beyond the user's expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The file tells the user to create ~/Clawic/data/redis-store/memory.md, which affects local user data. The document provides no warning or disclosure that it will create or modify a file on disk, so a user may not realize the action changes their filesystem.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.